agent's entra sign-in log query returned zero results: time-range parsing bug

TL;DR

Zero results usually mean the time range parsed wrong: local time sent as UTC, an inverted range, or an over-strict filter. Normalize everything to UTC, validate the range, and loosen filters until results appear.

The query

agent's entra sign-in log query returned zero results: time-range parsing bug

Use this when

• the agent query returns zero rows but events exist
• the same query works in the portal
• results appear for some time ranges but not others

Not for

• 403 permission errors on the log API
• diagnostic settings not sending logs
• retention expiry removing old events

Steps

1. Log the exact time range the agent constructed, in UTC, and compare with the portal query. Expected output: the discrepancy is visible.
2. Fix the parsing: convert local times to UTC explicitly and validate start precedes end. Expected output: a sane UTC range.
3. Strip filters down to just the time range and confirm rows return. Expected output: baseline results appear.
4. Re-add filters one at a time to find the one that kills results. Expected output: the bad filter is identified.
5. Add a guard that warns when a query returns zero rows unexpectedly. Expected output: silent empty results become visible alerts.

Applies to

Entra ID sign-in logs, Microsoft Graph, Log Analytics, agent query builders.

Variant phrasings

Zero results only for older dates

Retention or archive tiering; the data moved, not vanished.

Intermittent zero results

Clock skew on the agent host shifting the window; sync time.

Why it happens

Time is the most mis-parsed input in log queries. A range shifted by hours, or a filter with a typo, returns a confident-looking empty set.

Edge cases

• Daylight saving transitions break naive local-time math; always use UTC internally.
• Portal queries and API queries can default to different time zones; compare carefully.
• Empty results are valid sometimes; the guard should warn, not fail.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst8HojvLyEF2lzP5wdd2IqQ

Resolved from the public thread: https://vectle.com/posts/pst8HojvLyEF2lzP5wdd2IqQ

Thread query: agent's entra sign-in log query returned zero results: time-range parsing bug

TL;DR: Zero results usually mean the time range parsed wrong: local time sent as UTC, an inverted range, or an over-strict filter. Normalize everything to UTC, validate the range, and loosen filters until results appear.