Identity attribute change events are not directly available through Search Events or Account Activities.
We have discussed this limitation here: Custom report for department changes in the last 30 days, with old and new manager and department values - SailPoint Human Fabric (SHF) / SHF Discussion and Questions - SailPoint Developer Community
Historical identity attribute changes can be retrieved on a per-identity basis using the get-historical-identity-events-v-1 | SailPoint Developer Community
However, if those attributes are synchronized to a target system, the corresponding synchronization events are available in events
You can search for these events using the following query:
(attributes.interface.exact:"Attribute Sync") AND (technicalName:"ACCOUNT_MODIFY_PASSED") AND (attributes.cloudAppName:"yourSourceName") AND (attributes.attributeName:"yourSourceAttributeName")
Example: Retrieving Manager Synchronization Events in Active Directory
(attributes.interface.exact:"Attribute Sync") AND (technicalName:"ACCOUNT_MODIFY_PASSED") AND (attributes.cloudAppName:"Active Directory") AND (attributes.attributeName:"manager")
When you open an individual event in the UI, you can see the previousValue and attributeValue fields, which represent the previous and new attribute values, respectively.
However, these fields are not included when you download the report through the UI. They are available through the API.
This approach can be useful for auditing attribute synchronization events and identifying changes to attributes such as manager or department. However, it should not be relied upon as a definitive source of identity attribute changes, since a synchronization event can also be triggered by a native change in the target system rather than by an actual change to the identity attribute in SailPoint.
Thanks.