Those events are written to the AzureDiagnostics table, so just make sure your key vaults are sending data, then something like this should work. Both adding & removing users is a VaultPatch operation, and the columns will change slightly depending if its an add or remove
AzureDiagnostics
| where ResourceType == "VAULTS"
| where OperationName == "VaultPatch"
| where ResultType == "Success"
| extend UserObjectAdded = addedAccessPolicy_ObjectId_g
| extend UserObjectRemoved = removedAccessPolicy_ObjectId_g
| extend Actor = identity_claim_http_schemas_xmlsoap_org_ws_2005_05_identity_claims_name_s
| extend KeyAccessRemoved = tostring(removedAccessPolicy_Permissions_keys_s)
| extend SecretAccessRemoved = tostring(removedAccessPolicy_Permissions_secrets_s)
| extend CertAccessRemoved = tostring(removedAccessPolicy_Permissions_certificates_s)
| extend KeyAccessAdded = tostring(addedAccessPolicy_Permissions_keys_s)
| extend SecretAccessAdded = tostring(addedAccessPolicy_Permissions_secrets_s)
| extend CertAccessAdded = tostring(addedAccessPolicy_Permissions_certificates_s)
| where isnotempty( UserObjectAdded) or isnotempty( UserObjectRemoved)
| project ResourceType, OperationName, ResultType, id_s, Actor, UserObjectAdded, UserObjectRemoved, KeyAccessAdded, SecretAccessAdded, CertAccessAdded, KeyAccessRemoved, SecretAccessRemoved, CertAccessRemoved