Adding members to the organization

Open the GuardDuty console at https://console.amazonaws.cn/guardduty/.

To sign in, use the delegated GuardDuty administrator account credentials.

In the navigation pane, choose Accounts.

The accounts table displays all the member accounts that are active (not suspended Amazon Web Services accounts) and may be associated with the delegated GuardDuty administrator account. If the member account is associated with the organization's administrator account, then the Type will be one of the following: Via Organizations or By invitation. If a member account is not associated with the organization's GuardDuty administrator account, the Type of this member account is Not a member.

Select one or more account IDs that you want to add as members. These account IDs must have the Type as Via Organizations.

Accounts that are added through invitation are not a part of your organization. You can manage such accounts individually. For more information, see Managing accounts by invitation.

Choose the Actions dropdown, and then choose Add member. After you add this account as a member, the auto-enable GuardDuty configuration will apply. Based on the settings in Setting organization auto-enable preferences, the GuardDuty configuration of these accounts may change.

You can select the down arrow of the Status column to sort the accounts by the Not a member status and then choose each account that doesn't have GuardDuty enabled in the current Region.

If none of the accounts listed in the accounts table have been added as a member yet, you can enable GuardDuty in the current Region for all organization accounts. Choose Enable in the banner at the top of the page. This action automatically turns on the Auto-enable GuardDuty configuration so that GuardDuty gets enabled for any new account that joins the organization.

Choose Confirm to add the accounts as members. This action also enables GuardDuty for all of the selected accounts. The Status for the accounts will change to Enabled.

(Recommended) Repeat these steps in each Amazon Web Services Region. This ensures that the delegated GuardDuty administrator account can manage findings and other configurations for member accounts in all the Regions where you have GuardDuty enabled.

The auto-enable feature enables GuardDuty for all future members of your organization. This allows your delegated GuardDuty administrator account to manage any new members that are created within or get added to the organization. When the number of member accounts reaches the limit of 50,000, the Auto-enable feature is automatically turned off. If you remove a member account and the total number of members decreases to fewer than 50,000, the Auto-enable feature turns back on.