For authoritative application changes you can use this
For manual changes you have to configure OoTB auditing for identity updates