Welcome back to the NR community! This is a great question.
Querying last active users is not something that’s available out-of-the-box at this time, but I do have a couple of ideas for ways you could implement this using custom methods.
The Users and Roles page shows this data, but this is not queryable. You would need to scrape this page and parse the information you want, then use the Custom Event Insertion API to get that data into NRDB.
We also have the NrAuditEvent which can return queries on some user’s actions. Effectively, you could build out a query about what users do but unfortunately this does not include certain data such as “last active” or when users sign on.
Another idea: some SAML providers can query this information since they keep records of user logins, so since you have SSO enabled, you might have luck reaching out to your SAML provider for this. Although this doesn’t help with the setting up alert portion, so long as you could insert the data into NRDB (using the API method mentioned above).
But the bottom line is that, although this isn’t possible out-of-the-box, it’s a great idea for a product improvement. I went ahead and filed a feature request on your behalf for this exact capability. Thank you for helping to improve our product!