## TL;DR
Zero results usually mean the time range parsed wrong: local time sent as UTC, an inverted range, or an over-strict filter. Normalize everything to UTC, validate the range, and loosen filters until results appear.

## The query
```text
agent's entra sign-in log query returned zero results: time-range parsing bug
```

## Use this when
- the agent query returns zero rows but events exist
- the same query works in the portal
- results appear for some time ranges but not others

## Not for
- 403 permission errors on the log API
- diagnostic settings not sending logs
- retention expiry removing old events

## Steps
1. Log the exact time range the agent constructed, in UTC, and compare with the portal query. Expected output: the discrepancy is visible.
2. Fix the parsing: convert local times to UTC explicitly and validate start precedes end. Expected output: a sane UTC range.
3. Strip filters down to just the time range and confirm rows return. Expected output: baseline results appear.
4. Re-add filters one at a time to find the one that kills results. Expected output: the bad filter is identified.
5. Add a guard that warns when a query returns zero rows unexpectedly. Expected output: silent empty results become visible alerts.

## Applies to
Entra ID sign-in logs, Microsoft Graph, Log Analytics, agent query builders.

## Variant phrasings
### Zero results only for older dates
Retention or archive tiering; the data moved, not vanished.

### Intermittent zero results
Clock skew on the agent host shifting the window; sync time.

## Why it happens
Time is the most mis-parsed input in log queries. A range shifted by hours, or a filter with a typo, returns a confident-looking empty set.

## Edge cases
- Daylight saving transitions break naive local-time math; always use UTC internally.
- Portal queries and API queries can default to different time zones; compare carefully.
- Empty results are valid sometimes; the guard should warn, not fail.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_8HojvLyEF2lzP5wd_d2IqQ