Copy/paste reply (direct + closes the issue):
Hi Nilesh (and Thomas)
you’re not missing a checkbox.
You have 2 Options or approach for this
Option A (recommended in 8.4): Use Access History for real “what changed” timelines
IIQ 8.4 introduced Access History, which is specifically built to track history/deltas and supports objects including Workgroups (so you can answer “who were the historical members?”).
High-level steps:
-
Enable/configure Access History (separate Access History DB + queue + task).
-
Run/schedule Dispatch Access History.
-
Use the Access History UI / export, or query the Access History tables (workgroup capture/events are stored there).
This is the closest thing to an OOTB “diff” feature for the use case you described.
Note: Access History event timestamps reflect when the task ran (the capture time), not necessarily the exact second the admin clicked Save — that’s documented behavior.
Option B (if you must keep it in SPT_AUDIT_EVENT): Custom audit in the save workflow
If you need attribute-level “old/new” values in your existing audit trail, you’ll need to custom-log it:
-
Clone the workflow that saves the Role / Workgroup (or hook the save action you control)
-
Read/clone the object before update
-
Compare it to the object after update (e.g., compute member add/remove lists)
-
Write a custom AuditEvent (or persist the delta into a Custom object/table)
That will gives you exactly what auditors want: what changed + who + when + old/new but it’s custom because IIQ does not store that level of detail everywhere OOTB.
Some helpful links you may refer to
-
Community confirmation that OOTB doesn’t track “what changed” on config objects (only modified/modified-by):
https://developer.sailpoint.com/discuss/t/is-there-a-way-to-track-what-has-been-modified-changed-on-an-object/91822 -
IIQ 8.4 Access History guide (Workgroups + history/event capture):
https://community.sailpoint.com/mpomh84452/attachments/mpomh84452/IIQ_docs/648/3/8.4_IdentityIQ_AccessHistory.pdf -
Access History “How it works” (official doc page):
https://documentation.sailpoint.com/identityiq/help/access_history/how_access_history_works.html