I'm looking into a user's activity regarding their VPN sign-ins. They connect every morning from home, which seems normal, but the refresh interval is pretty long. This user has Outlook Mobile and Teams on their Android device and management is concerned that after connecting to the VPN, they might be slacking off. I noticed a ton of non-interactive sign-in logs for Outlook Mobile throughout the day, even during the night — at 6 AM, 10 PM, 11 PM, 1 AM, and 2 AM, when our work hours are only from 9 AM to 5 PM. So, I'm trying to figure out if these logs are just refresh signals or if they actually indicate the user is interacting with the app. The IP address remains mostly the same as the VPN. Any insights on why they'd be using Outlook Mobile if it's not job-related? Can anyone give me a clear answer on this?
3 Answers
Honestly, this feels more like a management issue than a tech issue. If he's getting his tasks done, what's the problem? If he’s not, then watching logs won’t help. Management should set clear expectations and metrics for performance instead of just spying on logs.
+1 to that! Tracking individual login times might be illegal in places like Germany and potentially throughout Europe, I’d take legal action if I were subjected to that.
I really don't get this request. If he’s doing his job, why does it matter what the logs say? I focus on the quality of work, deadlines, and tasks completed rather than tracking my employees' login times.
You should check the unified logs because they’ll show if the user has actually read emails or opened attachments. Keep in mind that login or token refreshes aren’t always reliable indicators of activity, so that data alone might not tell the full story.
100 percent agree with that, dig into the unified log!
I may be misunderstanding, but I’m in Entra a lot and haven’t heard of a unified log. Could you clarify what that is?
I agree! It feels like they’re being overly cautious here. If you suspect he's not completing his work, there are other ways to address it.