SG-SCCM how often is last logged in captured by SCCM? How does it affect timing of CMDB updates?

[VanGoghJoe1]

We have a client wanting to capture Last Logon user and timestamp, using SG-SCCM.

My understanding is SCCM does a hardware scan on a scheduled basis, weekly by default.   

Does anyone know if logon information is captured more frequently than that, or what triggers it?  

If so, does it anyone it updates any of the timestamps that the Computer Identity data source captures, like LastHWScan or TimeKey?

Also, I believe the CMDB is only updated when the SCCM import records are "newer" than the LastScan date on the Source [sys_object_source] records.  Does anyone know what date on the SCCM Computer Identity imports are tested against that LastScan date?  Is it LastHWScan from SCCM?   

If the logon info is captured by SCCM more recently than the last "hardware" scan, does that mean it might not get written to the CMDB?

(We're using SG-SCCM to track laptop info a client, but we do not have direct access to their environment, hard to investigate exactly how SCCM works.)

[SD_Chandan]

@VanGoghJoe1 

With SG‑SCCM, Last Logged On User is collected during SCCM hardware inventory, not in real time. By default, that inventory runs weekly, unless the SCCM client schedule is customized.

A user login does not trigger a new scan, so logon info may be stale until the next hardware inventory runs. ServiceNow updates the CMDB only when a newer SCCM inventory is imported, so newer logon data won’t update CMDB unless a fresh hardware scan is sent.

[VanGoghJoe1]

Thanks @SD_Chandan, that confirms what I've seen.

I've found that if I set the LastScan date on the Source records  where Source feed = SG-SCCM Computer Identity to an earlier date than the LastHWScan or just delete them altogether, then the Scheduled Data Import for Computer Identity will update the CMDB, but I can't tell if there any consequences for doing that besides the inefficiency.   

Has anyone done something similar before, or know of a better way to force an update?

What even makes those Source objects, is that in the SG-SCCM transform somewhere, or is the IRE doing that, or ... ?  Or maybe better, where is that check against the LastScan date on the Source records done?