Google Workspace through their APIs can provide all login activity
Google Workspace through their APIs can provide all login activity over a 180 day period. GAT takes advantage of these API capabilities and combined with some other security data, such as 2 Factor Authentication status we have enabled a security report for users.
Under the ‘Users’ tab click on the ‘Security’ tab here you can analysis which users don’t have 2FA turned ON and when they last login and when they enter their passwords incorrectly.
If you have a large domain it becomes difficult to identify users who have not logged in for a long time so using the ‘Apply custom filter’ button you can filter search for users who have not logged in for the last 3 months or 6 months if you wish.
You may find this post about how to get alerted every time a user disables two-factor authentication useful.