The short answer
It is the first moment a new user gets something real out of your product, and you find it by looking at what people who stuck around did in their first session that people who left did not. Pull your users into two groups, retained at day 30 and gone, then look for the action where the two groups diverge most sharply. It is usually smaller and earlier than you expect: not built a full workflow, but sent one message, imported one file, invited one colleague. Correlation is not enough on its own, so once you have a candidate, run an experiment that pushes more new users to do that thing and check whether retention actually moves. If it does not, you found a symptom of engaged users rather than a cause.