If you have the admin's use their extensions to login to the 3CX Management Portal, you can enable the email alerts that will notify you when that extension logs in and out and the email will give you the time frame. Example of our email notifications for logins are below. It does show the IP that they have accessed the 3CX Management Portal from.
-----------------------------------------------------------------------------------------------------------------------------------
3CX Management Console Login
So and So with extension number XXXXX, has logged in to 3CX Web Management Console.
IP Address:X.X.X.X
---------------------------------------------------------------------------------------------------------------------------------
3CX Management Console Logout
So and So with extension number XXXXX, has logged out from 3CX Web Management Console.
IP Address: X.X.X.X