You can determine all changes to made to users, roles, user-role assignments, profiles, authorizations, and authorization defaults.
Initial entries for role data are differentiated from empty entries in the result list by the comment "unknown".