---
title: "Mouse Jiggler Detection: A Documentation Review"
description: "What Teams, Slack, Intune, Defender, ActivTrak, and Hubstaff document about presence, usage, app inventory, and monitoring, with limits and primary sources."
canonical: "https://idlepilot.com/research/can-employers-detect-mouse-jigglers/"
updated: "2026-10-28"
generated_by: "scripts/build-markdown-twins.mjs"
---

> Markdown representation of https://idlepilot.com/research/can-employers-detect-mouse-jigglers/ — the HTML page at that URL is canonical and carries the same content.

# Mouse jiggler detection: a documentation review

Some employers can obtain evidence of activity-simulating tools, depending on their endpoint software and configuration. ActivTrak documents three detection approaches: software identification, pattern recognition, and duration analysis. That does not mean Teams or Slack's presence dot is a jiggler detector. This review separates presence, collaboration reports, device inventory, and monitoring claims; it does not test devices or estimate anyone's chance of being detected.

Sources: [ActivTrak: Detect Mouse Jigglers and Other Activity Mimicking Tools](#source-activtrak-pfa) ; [Microsoft Learn: User presence in Teams](#source-teams-presence) ; [Slack: Set your Slack status and availability](#source-slack-presence)

Last updated: October 28, 2026

Documentation review checked October 28, 2026. Microsoft Teams/Microsoft 365, Slack, Intune, Defender for Endpoint, ActivTrak, and Hubstaff. Capabilities depend on platform, permissions, licensing, enrollment, and configuration; no employer accounts or customer data were inspected.

## Findings you can cite

| Finding | Value | What it measures |
| --- | --- | --- |
| Presence and work output | Different measurements | Teams derives presence from activity, application state, and calendar information; Slack distinguishes availability from custom status. Neither definition verifies completed work. Sources: Microsoft Learn: User presence in Teams ; Slack: Set your Slack status and availability |
| Microsoft 365 user reports | Collaboration metrics over 7, 30, 90, or 180 days | The documented Teams User activity report includes messages, meetings, calls, durations, last activity date, and other activity. Those windows are report periods, not live presence histories. Sources: Microsoft Learn: Microsoft Teams User activity report |
| Slack member analytics | Activity is defined through messaging actions | Days active and last active use reading or sending a message, not simply the presence dot. Available metrics and access vary by plan and permissions. Sources: Slack: Understand the data in your Slack analytics dashboard ; Slack: View your Slack analytics dashboard |
| Dedicated monitoring | Documented signals, no independently measured accuracy here | ActivTrak describes software, repetitive-pattern, and duration signals; Hubstaff describes unusual activity and known simulation-app detection. Sources: ActivTrak: Detect Mouse Jigglers and Other Activity Mimicking Tools ; Hubstaff: Insights: Unusual Activity |

## Four kinds of evidence that should not be confused

The practical answer starts with what system produced a record. A coworker can notice a presence indicator without having endpoint-monitoring access. An administrator can have a usage report without having a complete record of mouse movement. Device-management and workforce-monitoring products add other capabilities when deployed.

The table classifies the evidence, not the employee. An inventory entry can support that software was recorded as installed; a running-process signal is a different observation. A pattern alert requires interpretation. None alone establishes the person's intent, the employer's rules, or the amount of useful work completed.

| Evidence layer | Documented examples | What it does not prove |
| --- | --- | --- |
| Presence | Teams current availability; Slack active/away. | That a jiggler was installed or that useful work happened. |
| Collaboration usage | Microsoft 365 Teams messages/meetings/calls; Slack member messaging activity. | A continuous keyboard log or automatic jiggler diagnosis. |
| Endpoint inventory and security events | Intune recorded applications; Defender documented connected-device properties/events. | That every portable app or every peripheral is classified correctly, or what a connected device was used for. |
| Dedicated monitoring | ActivTrak potential false activity; Hubstaff unusual activity and known simulation applications. | A universal detection rate, automatic misconduct finding, or coverage of every employer. |

Sources: [Microsoft Learn: User presence in Teams](#source-teams-presence) ; [Microsoft Learn: Microsoft Teams User activity report](#source-teams-usage) ; [Microsoft Learn: App inventory for Windows devices in Microsoft Intune](#source-intune-inventory) ; [ActivTrak: Detect Mouse Jigglers and Other Activity Mimicking Tools](#source-activtrak-pfa) ; [Hubstaff: Insights: Unusual Activity](#source-hubstaff-unusual)

## What Teams and Microsoft 365 reports show

Microsoft describes Teams presence as a combination of user activity, app state, and Outlook calendar information. It is an availability signal. This definition does not say that Teams' green dot identifies the source of an input event or labels a mouse jiggler.

The Microsoft 365 User activity report documents message and meeting counts, calls, participation durations, last activity date, and an Other activity field. Its audio/video duration measures participation, not active speaking or continuous camera use. A quiet workday is therefore not equivalent to a report of no work.

The separate Device usage report concerns the kinds of clients people use to access Teams. Microsoft lists platform categories such as Windows, Mac, web, iOS, and Android. Despite its title, this is not a USB peripheral inventory. An administrator must use the relevant report and have the required access; the existence of a feature does not show that an individual manager routinely checks it.

Sources: [Microsoft Learn: User presence in Teams](#source-teams-presence) ; [Microsoft Learn: Microsoft Teams User activity report](#source-teams-usage) ; [Microsoft Learn: Microsoft Teams Device usage report](#source-teams-devices)

## What Slack analytics means by active

Slack's availability guide says desktop inactivity and leaving the mobile app affect the dot. Its analytics definitions use a separate concept: a member's days active and last active are based on reading or sending messages in a channel or direct message. Messages posted is another distinct metric.

Slack says dashboard detail depends on the subscription, and member analytics access is controlled by owner settings and roles. The reviewed metric list does not turn a presence indicator into an all-day input record. Equally, that list cannot establish that an employer has no other monitoring outside Slack.

Sources: [Slack: Set your Slack status and availability](#source-slack-presence) ; [Slack: Understand the data in your Slack analytics dashboard](#source-slack-metrics) ; [Slack: View your Slack analytics dashboard](#source-slack-analytics)

## Device management can reveal different information

Intune's Windows app-inventory documentation describes collection of installed-application metadata, including name, version, publisher, and optional installation information. It requires Intune enrollment, Microsoft Entra joined Windows devices, and an assigned collection policy. The source also warns that not every property is available for every application.

Microsoft Defender for Endpoint separately documents basic connected-device auditing on onboarded endpoints, device properties, and Plug and Play connection events. Its walkthrough uses USB drives and other supported device-control scenarios. Those examples justify saying security products can collect connection evidence; they do not justify promising that every hardware jiggler will be uniquely identified.

This distinction also limits negative claims. Failure to see an app in one inventory view would not establish that no other security or monitoring system recorded a process, event, or unusual behavior. That is an inference about the evidence layers, not a test of a particular company's setup.

Sources: [Microsoft Learn: App inventory for Windows devices in Microsoft Intune](#source-intune-inventory) ; [Microsoft Learn: Device control walkthroughs](#source-defender-devices)

## What dedicated monitoring vendors claim

ActivTrak documents known-process identification, repetitive-pattern detection, and duration analysis. Its software signal can identify a running process without proving that process was actively simulating input. Repetitive-pattern coverage is Windows-only in the checked guide, and behavior depends on agent version. Alerts are investigation signals; they are not independent proof of intent.

Hubstaff's Insights documentation describes known simulation-app detection while tracking time and automated-input pattern flags. It says unusual activity can be legitimate and should be considered with other information. Screenshots are available only if captured and the viewer has permission. These statements describe deployed product capabilities, not an experiment confirming success against any specific device.

Sources: [ActivTrak: Detect Mouse Jigglers and Other Activity Mimicking Tools](#source-activtrak-pfa) ; [Hubstaff: Insights: Unusual Activity](#source-hubstaff-unusual)

## What a reader can establish from this review

Ask which product, report, and observation support a claim. Installed software, a running process, a connected device, a repetitive pattern, and a green dot are separate statements with different evidential limits. Employer policy is another separate question; no visibility claim establishes approval to use a tool.

Idle Pilot prepared this as a source-linked document review checked October 28, 2026. Cite the specific vendor page alongside the relevant finding. We did not install jigglers, run detection trials, inspect employer systems, or compare ways to avoid monitoring. No result here makes a tool invisible or converts presence into a time sheet.

Sources: [Microsoft Learn: App inventory for Windows devices in Microsoft Intune](#source-intune-inventory) ; [Microsoft Learn: Device control walkthroughs](#source-defender-devices) ; [Microsoft Learn: User presence in Teams](#source-teams-presence) ; [Hubstaff: Insights: Unusual Activity](#source-hubstaff-unusual)

## Method

Opened first-party product support, administrator, and metric-definition pages, prioritizing current documentation over reviews and anecdotal detection stories.

Separated presence, collaboration reports, endpoint inventory/security telemetry, and dedicated monitoring so that a capability from one layer was not attributed to another.

Recorded prerequisites and platform restrictions when present. Vendor claims about detection were attributed to their publisher rather than treated as independently replicated results.

No original experiment, controlled device sample, employer survey, production query, or customer-data analysis was conducted.

### Limitations

-   The study cannot identify which tools a specific employer has deployed or who can access its reports.
-   Documentation does not provide a comparable independent benchmark, false-positive rate, or denominator covering all software and hardware jigglers.
-   An app inventory, a process alert, and a behavior flag support different claims. None on its own establishes intent or a policy violation.
-   Vendor pages may change; unknown implementation details and unavailable tenant settings remain unknown.

## What we could not establish

-   Teams or Slack always records a mouse-jiggler verdict in its standard presence interface.
-   Every employer can detect every device, or no employer can detect hardware activity simulation.
-   Vendor confidence percentages as independent detection-accuracy estimates across all devices.
-   A missing inventory entry, an unchanged dot, or an untriggered alert as proof of invisibility or employer approval.

## FAQ

Can Teams itself tell my employer that I use a mouse jiggler?

The reviewed Teams presence and Microsoft 365 usage documentation does not define a jiggler verdict in the status dot. Separate endpoint-security or monitoring software can supply other signals. Absence from the presence guide does not prove absence elsewhere.

Is a Teams Device usage report a list of attached mice?

No. The cited Microsoft 365 report describes client/platform usage, including desktop, web, and mobile categories. Peripheral connection evidence belongs to a different product or endpoint record.

Can Slack admins see more than my green dot?

Depending on plan, role, and settings, Slack analytics can show member activity such as days active, last active, and messages posted. Those metrics have their own definitions and are not a continuous presence or keyboard log.

Does a software detection alert prove the tool was moving the mouse?

Not necessarily. ActivTrak explicitly distinguishes a known application running as a process from proof that it was actively simulating input at that moment.

Does a monitoring flag prove someone was not working?

No. Hubstaff says unusual activity can reflect legitimate work and calls for other evidence. The flag's meaning, captured context, permissions, and applicable workplace policy all matter.

Did this research test any mouse jigglers?

No. It compared published vendor documentation. It provides no success rate, undetectability finding, evasion instructions, or assessment of a particular employer's installation.

## Sources and citation notes

Cite the original source and its date for each figure. For our own studies, include the sample and limitations above.

1.  [Microsoft Learn: User presence in Teams](https://learn.microsoft.com/en-us/microsoftteams/presence-admins)

    Published:

    Updated 2026-07-16

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Teams current presence inputs and device-dependent behavior.

    Checked:

    2026-10-28

2.  [Slack: Set your Slack status and availability](https://slack.com/help/articles/201864558-Set-your-Slack-status-and-availability)

    Published:

    Not stated

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Slack availability and custom status; desktop/mobile differences.

    Checked:

    2026-10-28

3.  [Microsoft Learn: Microsoft Teams User activity report](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-teams-user-activity-preview?view=o365-worldwide)

    Published:

    Updated 2026-07-07

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Microsoft 365 administrator reporting; stated metrics and reporting periods.

    Checked:

    2026-10-28

4.  [Microsoft Learn: Microsoft Teams Device usage report](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-teams-device-usage-preview?view=o365-worldwide)

    Published:

    Not stated

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Teams client/platform usage in Microsoft 365; not connected peripherals.

    Checked:

    2026-10-28

5.  [Slack: View your Slack analytics dashboard](https://slack.com/help/articles/218407447-View-your-Slack-analytics-dashboard)

    Published:

    Not stated

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Plan- and permission-dependent workspace and organization analytics.

    Checked:

    2026-10-28

6.  [Slack: Understand the data in your Slack analytics dashboard](https://slack.com/help/articles/360057638533-Understand-the-data-in-your-Slack-analytics-dashboard)

    Published:

    Not stated

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Definitions of member days active, last active, and messages posted.

    Checked:

    2026-10-28

7.  [Microsoft Learn: App inventory for Windows devices in Microsoft Intune](https://learn.microsoft.com/en-us/intune/app-management/deployment/enhanced-app-inventory)

    Published:

    Updated 2026-04-30

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Enrolled, Entra joined Windows 10/11 devices with collection policy assigned.

    Checked:

    2026-10-28

8.  [Microsoft Learn: Device control walkthroughs](https://learn.microsoft.com/en-us/defender-endpoint/device-control-walkthroughs)

    Published:

    Updated 2025-01-24

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Defender-onboarded endpoints; device-control auditing examples and connected-device properties, not a jiggler-specific benchmark.

    Checked:

    2026-10-28

9.  [ActivTrak: Detect Mouse Jigglers and Other Activity Mimicking Tools](https://support.activtrak.com/hc/en-us/articles/4406765537563-Detect-Mouse-Jigglers-and-Other-Activity-Mimicking-Tools)

    Published:

    Published 2021-09-14; updated 2026-10-06

    Population or sample:

    No original participant sample; vendor documentation, not an independent detection benchmark

    Scope:

    Vendor's claimed potential-false-activity features; agent/version/platform conditions. No independent validation sample supplied here.

    Checked:

    2026-10-28

10.  [Hubstaff: Insights: Unusual Activity](https://support.hubstaff.com/hubstaff-insights-unusual-activity/)

     Published:

     Not stated

     Population or sample:

     No original participant sample; vendor documentation, not an independent detection benchmark

     Scope:

     Hubstaff Insights feature definitions; time-tracked app detection and contextual review of unusual input.

     Checked:

     2026-10-28

## Related guides and tools

-   [Compare mouse-jiggler alternatives](https://idlepilot.com/mouse-jiggler-alternatives/)
-   [Read dated public workplace cases](https://idlepilot.com/research/mouse-jigglers-at-work-public-cases/)
-   [Compare documented presence rules](https://idlepilot.com/research/presence-timeouts-in-work-chat-apps/)
-   [Employer visibility and presence: the practical guide](https://idlepilot.com/can-my-company-see-if-im-faking-my-slack-status/)

## Keep Slack or Teams Available during saved hours, even with your computer off.

[Try Idle Pilot free](https://app.idlepilot.com)

3-day free trial · No credit card