Start with the tenant logs - these have login and logout entries. Then your log processing platform should be able to determine what you need.
This is an unusual use case, and you may find it doesn’t fit well. For starters, there is no “logout” for a session timeout. So you may not be able to determine when a user stopped.
If this is employee productivity, there are alternate approaches such as Prodoscore: https://www.prodoscore.com/