Detecting anomalous identity and access management action events

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a system for detecting anomalous identity and access management (IAM) actions, cause the system to:
• obtain a change order associated with an environment;
• determine, based on the change order, one or more expected IAM actions associated with the change order;
• monitor an IAM session in the environment that is associated with a user account associated with the change order;
• determine, based on monitoring the IAM session and based on the one or more expected IAM actions, that an anomalous IAM action event has occurred;
• and
• send a notification indicating that the anomalous IAM action event has occurred.

A method, comprising:

• determining, by a system for detecting anomalous identity and access management (IAM) actions and based on a change order associated with an environment, one or more expected IAM actions associated with the change order;
• monitoring, by the system, an IAM session in the environment that is associated the change order;
• determining, by the system, based on monitoring the IAM session, and based on the one or more expected IAM actions, that an anomalous IAM action event has occurred;
• and
• causing, by the system, and based on determining that the anomalous IAM action event has occurred, one or more actions to be performed.