We want to make sure we are ready for NLAuth to be shut down. How do I find out if anything is using NLAuth to connect to NetSuite, without hunting down every single integration, app, or other user agent that might possibly use it?

Usually people know which integration requires NLAuth since every password change requires them to also give away their password again. If you don't trust your users to know when they give away their password then you can use the login audit trail to find probable nlauth logins. Use the login audit trail to find logins that have an integration but no access token that are going to an integration related url.

Thanks