Remove a member account from your organization - Amazon Organizations
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Remove a member account from your organization

When you sign in to the organization's management account, you can remove member accounts from the organization that you no longer need. To do this, complete the following procedure. This procedure applies only to member accounts. To remove the management account, you must delete the organization.

Note

If a member account is removed from an organization, that member account will no longer be covered by organization agreements. Management account administrators should communicate this to member accounts before removing member accounts from the organization, so that member accounts can put new agreements in place if necessary. A list of active organization agreements can be viewed in the Amazon Artifact console on the Amazon Artifact Organization Agreements page.

Minimum permissions

To remove one or more member accounts from your organization, you must sign in as a user or role in the management account with the following permissions:

  • organizations:DescribeOrganization – required only when using the Organizations console

  • organizations:RemoveAccountFromOrganization

If you choose to sign in as a user or role in a member account in step 5, then that user or role must have the following permissions:

  • organizations:DescribeOrganization – required only when using the Organizations console.

  • organizations:LeaveOrganization – Note that the organization administrator can apply a policy to your account that removes this permission, preventing you from removing your account from the organization.

  • If you sign in as an IAM user and the account is missing payment information, the user must have either aws-portal:ModifyBilling and aws-portal:ModifyPaymentMethods permissions (if the account has not yet migrated to fine-grained permissions) OR payments:CreatePaymentInstrument and payments:UpdatePaymentPreferences permissions (if the account has migrated to fine-grained permissions). Also, the member account must have IAM user access to billing enabled. If this isn't already enabled, see Activating Access to the Billing and Cost Management Console in the Amazon Billing User Guide.

Amazon Web Services Management Console
To remove a member account from your organization

  1. Sign in to the Amazon Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.

  2. On the Amazon Web Services accounts page, find and choose the check box next to each member account that you want to remove from your organization. You can navigate the OU hierarchy or enable View Amazon Web Services accounts only to see a flat list of accounts without the OU structure. If you have a lot of accounts, you might have to choose Load more accounts in 'ou-name' at the bottom of the list to find all of those you want to move.

    On the Amazon Web Services accounts page, find and choose the name of the member account that you want to remove from your organization. You might have to expand OUs (choose the ) to find the account that you want.

  3. Choose Actions, then under Amazon Web Services account, choose Remove from organization.

  4. In the Remove account 'account-name' (#account-id-num) from organization? dialog box, choose Remove account.

  5. If Amazon Organizations fails to remove one or more of the accounts, it's typically because you have not provided all the required information for the account to operate as a standalone account. Perform the following steps:

    1. Sign in to the failed accounts. We recommend that you sign in to the member account by choosing Copy link, and then pasting it into the address bar of a new incognito browser window. If you don't use an incognito window, you're signed out of the management account and won't be able to navigate back to this dialog box.

    2. The browser takes you directly to the sign-up process to complete any steps that are missing for this account. Complete all the steps presented. They might include the following:

      • Provide contact information

      • Provide a valid payment method

      • Verify the phone number

      • Select a support plan option

    3. After you complete the last sign-up step, Amazon automatically redirects your browser to the Amazon Organizations console for the member account. Choose Leave organization, and then confirm your choice in the confirmation dialog box. You are redirected to the Getting Started page of the Amazon Organizations console, where you can view any pending invitations for your account to join other organizations.

    4. Remove the IAM roles that grant access to your account from the organization.

      Important

      If your account was created in the organization, then Organizations automatically created an IAM role in the account that enabled access by the organization's management account. If the account was invited to join, then Organizations did not automatically create such a role, but you or another administrator might have created one to get the same benefits. In either case, when you remove the account from the organization, any such role isn't automatically deleted. If you want to terminate this access from the former organization's management account, then you must manually delete this IAM role. For information about how to delete a role, see Deleting roles or instance profiles in the IAM User Guide.

Amazon CLI & Amazon SDKs
To remove a member account from your organization

You can use one of the following commands to remove a member account:

After the member account has been removed from the organization, make sure to remove the IAM roles that grant access to your account from the organization.

Important

If your account was created in the organization, then Organizations automatically created an IAM role in the account that enabled access by the organization's management account. If the account was invited to join, then Organizations did not automatically create such a role, but you or another administrator might have created one to get the same benefits. In either case, when you remove the account from the organization, any such role isn't automatically deleted. If you want to terminate this access from the former organization's management account, then you must manually delete this IAM role. For information about how to delete a role, see Deleting roles or instance profiles in the IAM User Guide.

Member accounts can remove themselves with leave-organization instead. For more information, see Leave an organization from your member account.