Abstract: A system for detecting anomalous identity and access management (IAM) actions obtains a change order that indicates one or more changes to be implemented in an environment. The system determines one or more expected IAM actions associated with the change order and identifies a user account associated with implementing the one or more changes in the environment. The system monitors an IAM session in the environment that is associated with the user account for an activity of the user account. The system determines, based on monitoring the IAM session and based on the one or more expected IAM actions, that an anomalous IAM action event has occurred. The system sends, to another device and based on determining that the anomalous IAM action event has occurred, a notification indicating that the anomalous IAM action event has occurred.