Management asked me whether there is a reliable technical way to determine if a user is working during their scheduled hours. The work is complex engineering and design, so simply checking whether tasks were completed may not reveal rushed or inaccurate work until much later, potentially creating safety issues. I am not looking for spyware, keyloggers, or random screenshots, and I understand that login and application logs are not the same as proof of productivity. I need to provide an honest explanation of what IT can and cannot verify, along with any useful technical data that might support a management or HR investigation.
5 Answers
This should primarily be handled by the employee's manager and HR. They need to define expectations, deadlines, quality standards, availability, and billable hours, then address missed work or poor performance directly. For complicated work, review processes, peer checks, milestones, and quality assurance are much more meaningful than counting keyboard activity or application launches.
There is no reliable way for IT to prove that someone is working just from sign-in data. Authentication logs show that an account logged in, a token refreshed, or a machine connected; they do not show how productively someone worked. One person might sign in once and work all day, while another generates dozens of events from VPN, email, collaboration tools, and background processes. Provide the relevant logs with a clear disclaimer that they are activity records, not productivity measurements.
If management has a specific, legitimate question, IT can answer that narrow question using systems within its scope—for example, whether the user accessed a required application, connected to the VPN, or modified a particular resource during a defined period. Entra or directory sign-in logs, VPN records, endpoint management data, file access audits, and Microsoft 365 activity reports may help establish system usage, but none of them can establish that the person was working continuously or doing quality work.
The safest response is something like: 'I can provide the login, VPN, application, and resource-access records available to me, but I cannot determine whether the employee was working or how good the work was.' Keep the report factual, limited to the requested dates and systems, and avoid interpreting normal or missing activity. If the concern is safety-critical work, strengthen review and approval procedures rather than trying to infer productivity from computer logs.
Avoid introducing screen capture, keylogging, or productivity-monitoring software just to solve this. Those tools can create privacy, labor-law, security, and employee-morale problems, and they still measure activity rather than results. If surveillance is being seriously considered, management should first define the policy and obtain qualified legal guidance. Otherwise, IT risks turning weak evidence into an unfair employment decision.
Exactly. Someone can spend hours researching, designing, attending meetings, or thinking through a problem without generating much log activity. Conversely, a person can create plenty of events without accomplishing anything useful.