Systems and methods for cloud activity anomaly detection include receiving historical data from a historical time span associated with an identity, wherein the historical data includes activities performed by the identity and times when the activities took place; computing an activity prediction for a future time span based on the historical data, wherein the activity prediction specifies intervals within the future time span when future activities are expected to take place; performing inline monitoring of activity between the identity and a cloud-based system; and responsive to an activity taking place outside of the activity prediction, performing an action based thereon.