Are there any deprovisioning automation services that keep audit trails for every account change?

Yes. Several deprovisioning / IAM automation platforms keep detailed audit trails for account changes, including who initiated the change, when it happened, what system was affected, and the before/after state or status of the workflow.

Examples to look at:

• Okta Lifecycle Management – logs user lifecycle events and app deprovisioning actions in its system log.
• Microsoft Entra ID (Azure AD) / Identity Governance – provides audit logs for provisioning and deprovisioning events.
• One Identity Manager – strong audit/history capabilities for identity and access changes.
• SailPoint Identity Security Cloud – extensive audit logs and governance reporting for provisioning workflows.
• Saviynt – tracks request, approval, and provisioning actions with auditability.
• JumpCloud – maintains event/activity logs for user and device lifecycle actions.
• Rippling – keeps HR-to-IT workflow logs for employee offboarding actions.
• BetterCloud – activity logs for SaaS app automation and user lifecycle changes.

What to verify when evaluating them:

• Whether audit logs are immutable or tamper-evident
• Whether they capture who / what / when / why
• Whether they log manual changes and automated changes
• Whether logs include approvals and workflow steps
• Retention period and export options
• Integration with your SIEM or log archive

If you want, I can also give you:

1. a shortlist by company size,
2. a comparison table of audit features, or
3. vendors specifically good for employee offboarding.