Presence

The Presence tab answers one question: for the hours somebody was expected to be available, how often did they leave a trace from a network the organisation recognises?

It is a real question with a real use — “is this person coming to the office as much as they should?” — and it is also the question in this tool most likely to be misread. So the figure it produces is deliberately a floor, and the screen says so wherever it appears.

Before it can run

Two inputs, both under Known networks:

• Declared networks — at least one, or the analysis reports that it could not run rather than reporting zero hours. “Nobody said where the office is” and “nobody was ever at the office” are not the same answer. See Addresses and networks.
• Availability hours — the window and weekdays somebody is expected to be reachable, for example 09:00–18:00 Monday to Friday. It is deliberately not called working hours: the same window means “shift”, “core hours” or “on call” in different organisations, and the tool takes no view.

The time zone in the toolbar decides which local hour every event falls in, with daylight saving applied on the correct dates. Changing it re-runs the analysis.

What “confirmed” means

An hour is confirmed when at least one event in it arrives from a declared network. One action marks the whole hour — reading a single message at 10:04 confirms 10:00–11:00.

That makes it a floor, not a measurement. Somebody who worked all afternoon and touched nothing between 14:00 and 16:00 has two unconfirmed hours; they were still there. Low confirmed hours are not evidence of absence — they are the absence of evidence of presence, which is a weaker statement and has to stay weaker.

Each hour ends up in one of five states, and the two that are easiest to confuse are kept apart on purpose:

• Confirmed — activity from a declared network.
• Confirmed, mixed — activity from a declared network and from another one in the same hour. Still confirmed.
• Unrecognised network — there was activity, but none of it from a network you declared. The tooltip says it in as many words: not evidence of being away.
• Cannot place — activity that places nobody: no address at all, a private address, or service infrastructure. This is where Microsoft’s own servers go, so they are never counted as “somewhere else”.
• Nothing — no activity recorded. Also not evidence of being away.

A sixth appears only on the day the clocks move forward, for the hour that does not exist.

The distinction between Unrecognised network and Nothing is the one that matters. An address you have not declared does not make an hour empty — it makes it unexplained, and clicking the cell hands those addresses to the IPs tab so you can decide whether that network is worth declaring.

Telling service traffic apart needs the operator database, which the tab loads on entry; until it resolves, the analysis says it cannot tell rather than guessing.

The four views

The panel on the left explains, in words and with the numbers, whatever chart is on screen. The carousel on the right holds:

• Week shape — the seven days by hour, aggregated over the whole period. Where the rhythm actually is.
• By month — confirmed hours against expected hours, month by month.
• By week — the same, week by week.
• Day by day — one row per day, one cell per hour, in the five states above.

Cells are clickable: selecting one hands its events to the IPs tab, filtered to the addresses behind it, so a suspicious block can be turned into “which addresses were these” in one step.

Time spent working is a different figure

The report also carries an active hours figure, and the two are not interchangeable:

• Confirmed hours measure where. Any activity in an hour from a declared network marks that whole hour.
• Active hours measure how much. Consecutive events on one local day are chained, and a gap between two of them counts as worked time when it is 30 minutes or less.

Active hours will always be the smaller number. Neither is a substitute for the other, and the report prints a paragraph saying so beside them.

Active hours also depend on the interactive/automatic classification, because counting background mail synchronisation produced 1,655 hours over six months on one export, and a peak week of 103.4 out of the 168 hours a week contains. The report prints that unfiltered figure beside the filtered one as evidence the exclusion is doing real work. See Interactive and automatic activity.

What this cannot tell you

• Whether somebody was in a building. It tells you an address was used. A VPN, a forgotten session or somebody else on the same office network all look identical.
• Whether a quiet week was leave. There is no holiday calendar and no way to mark a day as excluded, so a public holiday, annual leave and sick leave all look like an absence. If that matters to a case, say so in the report notes.
• Anything about work that leaves no audit trail. A day of meetings, a phone call and an afternoon reading on paper are all invisible to Microsoft 365.