You want to enforce some more controls when you access to critical things, such as AWS, you can't with Google. It has no granular controls. Otherwise it's much easier. We use JumpCloud though, it's a mix between and more comprhensible.
Proper RBAC is as granular as necessary, but no more
Proper RBAC also links everything needed by a certain role together
Merely knowing who logged-in where and when, though, is not enough - you also need to know what they did while there (and that they did not do anything they were not supposed to be able to do (which links back to proper RBAC'ing))
CIS, HIPAA, FISMA, SOX, STIG and all the other alphabet soup compliance rules, frameworks, etc are a lot more extensive than just "who logged in where" :)
--------
See NIST's page on RBAC for some of this: https://csrc.nist.gov/Projects/Role-Based-Access-Control