Answer
One confirmed approach queries the user-client-profile tables directly — joining the profile identity table to its associated profile-value table and taking the most recent modified-date per user gives a workable last-accessed timestamp per user, as an alternative to relying on the newer login-event tables (which may not retain long-term history) or an external identity provider's own sign-in logs.