Under Organization > Monitor > Login attempts you can configure to send It for a syslog server:
![alemabrahao_0-1677788414370.png alemabrahao_0-1677788414370.png](https://community.meraki.com/t5/image/serverpage/image-id/28598i911236A9DB4F2FD4/image-size/medium?v=v2&px=400)
I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.
Please, if this post was useful, leave your kudos and mark it as solved.