How to Investigate Suspicious Changes to Cloud Identity Policies

Unexpected identity policy changes can broaden access or block normal users and may originate from automation or compromised credentials.

Checks to make

Review audit events, actor identity, change diff, approval record, and related sign-ins. Confirm with the change owner through a trusted channel, preserve policy versions, and contain unauthorized access according to response procedures.

When to get help

Security operations can investigate identity changes and validate approvals. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.