How to View Delegated Administrator Accounts in AWS Organizations for Different Services

Introduction

AWS Organizations helps organizations centrally manage multiple AWS accounts. To improve security and simplify administration, AWS allows supported services to use a delegated administrator account instead of relying entirely on the AWS Organizations management account.

A delegated administrator is a member account that has been registered to administer a specific AWS service across an organization. Depending on the service, this account can manage security findings, monitoring, compliance, and other organization-wide activities.

In this blog, we will explore how to identify delegated administrator accounts in AWS Organizations using the AWS Management Console and AWS Command Line Interface (AWS CLI).

What Is a Delegated Administrator in AWS?

A delegated administrator is an AWS Organizations member account assigned administrative responsibilities for a supported AWS service.

For example, an organization might use:

  • Amazon GuardDuty for threat detection.
  • AWS Security Hub for security posture management.
  • Amazon Macie for sensitive data discovery.
  • AWS IAM Identity Center for workforce access management.
  • AWS CloudFormation StackSets for centralized stack administration.

Delegated administration is service-specific. An account registered as the delegated administrator for one service does not automatically become the delegated administrator for every other service.

AWS recommends using member accounts for appropriate administrative tasks instead of relying exclusively on the organization’s management account.

For more information, refer to the AWS Organizations documentation.

Prerequisites

Before checking delegated administrator accounts, make sure you have:

  • Access to the AWS Organizations management account, or another account and role authorized to perform the required read operations.
  • AWS CLI installed and configured if you plan to use command-line instructions.
  • Appropriate IAM permissions to list delegated administrators and delegated services.
  • The AWS service name or service principal if you want to check a particular service.

Note: The AWS Organizations management account is the recommended starting point for organization-wide auditing.

Method 1: View Delegated Administrator Accounts Using AWS CLI

AWS CLI provides a straightforward way to identify the accounts registered as delegated administrators for services in your organization.

Step 1: List all delegated administrator accounts

Run the following command:

aws organizations list-delegated-administrators

This command lists the delegated administrator accounts registered across the organization.

Example output:

{
  "DelegatedAdministrators": [
    {
      "Id": "111122223333",
      "Arn": "arn:aws:organizations::123456789012:account/o-exampleorgid/111122223333",
      "Email": "[email protected]",
      "Name": "SecurityAccount",
      "Status": "ACTIVE"
    }
  ]
}

The output may include additional fields, such as the date delegation was enabled and the method used to join the organization.

Step 2: Understand the command output

The following fields are useful when auditing delegated administrators:

  • Id: The AWS account ID of the delegated administrator.
  • Name: The account name.
  • Arn: The Amazon Resource Name identifying the account within the organization.
  • Email: The email address associated with the account.
  • Status: The account’s organization membership status.

The command identifies delegated administrator accounts, but it does not by itself show every service associated with each account.

Step 3: Find the services managed by a specific account

Copy the account ID from the previous output and run:

aws organizations list-delegated-services-for-account \
  --account-id 111122223333

Replace 111122223333 with the actual account ID.

This command returns the AWS services for which that account is registered as a delegated administrator.

Example output:

{
  "DelegatedServices": [
    {
      "ServicePrincipal": "guardduty.amazonaws.com",
      "DelegationEnabledDate": "2026-01-15T10:30:00Z"
    },
    {
      "ServicePrincipal": "securityhub.amazonaws.com",
      "DelegationEnabledDate": "2026-02-10T12:00:00Z"
    }
  ]
}

The example is illustrative. Your results depend on the services configured in your organization.

Step 4: Check the delegated administrator for a particular service

If you want to identify the account managing a specific AWS service, use the --service-principal parameter.

For example, to list delegated administrators for Amazon GuardDuty:

aws organizations list-delegated-administrators \
  --service-principal guardduty.amazonaws.com

To check AWS Security Hub:

aws organizations list-delegated-administrators \
  --service-principal securityhub.amazonaws.com

To check Amazon Macie:

aws organizations list-delegated-administrators \
  --service-principal macie.amazonaws.com

These commands return the accounts registered for the specified service. Always verify the correct service principal against the relevant AWS service documentation.

Method 2: View Delegated Administrators in the AWS Management Console

You can also review delegated administration through the AWS console, depending on the service and the console features available.

Step 1: Sign in to AWS Organizations

  1. Sign in to the AWS Management Console using an authorized account.
  2. Open the AWS Organizations console.
  3. Select the organization you want to review.

For organization-wide visibility, use the management account or an appropriately authorized role.

Step 2: Review the organization’s services

Navigate to the AWS Organizations area for services integrated with your organization.

Review the services for which trusted access is enabled. Trusted access allows supported AWS services to integrate with AWS Organizations, but enabling trusted access does not necessarily mean a delegated administrator has been registered.

Step 3: Check the service-specific console

For the service you want to audit, open its AWS console and look for the delegated administrator or organization management settings.

Depending on the service, the relevant option may appear under settings, organization configuration, administrator accounts, or a similar section.

For example, AWS IAM Identity Center provides delegated administrator information in its settings. Other services may provide their own organization-level administration pages.

Important: The exact console navigation varies by service. If you need a complete inventory across all services, AWS CLI is generally the more consistent approach.

Method 3: Automate the Delegated Administrator Audit

For larger AWS environments, you may want to automate the review rather than manually checking each account.

The following Bash script retrieves the delegated administrator accounts and then lists the delegated services associated with each account.

#!/usr/bin/env bash

set -euo pipefail

echo "Delegated Administrator Audit"
echo "============================="

accounts=$(aws organizations list-delegated-administrators \
  --query 'DelegatedAdministrators[].Id' \
  --output text)

if [[ -z "$accounts" || "$accounts" == "None" ]]; then
  echo "No delegated administrator accounts found."
  exit 0
fi

for account_id in $accounts; do
  echo
  echo "Account ID: $account_id"

  aws organizations list-delegated-services-for-account \
    --account-id "$account_id" \
    --query 'DelegatedServices[].ServicePrincipal' \
    --output table
done

How the script works

  1. Retrieves the delegated administrator account IDs.
  2. Iterates through each account.
  3. Retrieves the services for which each account is a delegated administrator.
  4. Displays the results in a readable table.

Run this script using credentials that have the necessary AWS Organizations permissions.

For production use, consider adding account names, error handling, pagination-aware processing where needed, and CSV or JSON export for reporting.

Common Issues and Troubleshooting

1. Access denied error

If you receive an AccessDeniedException, verify that your IAM identity has permission to perform the relevant AWS Organizations read operations, including:

  • organizations:ListDelegatedAdministrators
  • organizations:ListDelegatedServicesForAccount

Also verify that your credentials are for the intended AWS account and that applicable policies allow the requested operation.

2. No delegated administrator accounts are returned

If the command returns an empty list, possible explanations include:

  • No delegated administrators have been registered.
  • You are querying a different organization than expected.
  • The current credentials do not provide the intended organization context.

Confirm the organization and account configuration before concluding that delegation is not configured.

3. A service does not appear in the results

Confirm that the service supports delegated administration and that the intended member account has been registered for that service.

Enabling trusted access alone does not necessarily register a delegated administrator.

4. You are unsure which service principal to use

Consult the official AWS documentation for the specific service. Service principal names can differ, and the correct value is required when filtering delegated administrators by service.

Best Practices for Managing Delegated Administrators

  • Use dedicated member accounts: Consider separating security, operations, and shared-service administration from application workloads.
  • Apply least privilege: Grant only the IAM permissions required for the delegated responsibilities.
  • Audit regularly: Review delegated administrator assignments periodically and whenever responsibilities change.
  • Document ownership: Maintain a record of the service, delegated account ID, business owner, and purpose of the delegation.
  • Review before account removal: Deregister delegated administrators from applicable services before removing their accounts from an organization.
  • Verify service support: Consult the current AWS documentation because delegated administration capabilities and setup procedures vary by service.

Conclusion

AWS Organizations makes it possible to distribute administrative responsibilities across member accounts through delegated administration.

To review your configuration, start with:

aws organizations list-delegated-administrators

Then identify the services associated with an account:

aws organizations list-delegated-services-for-account \
  --account-id 111122223333

To check a specific service, use:

aws organizations list-delegated-administrators \
  --service-principal guardduty.amazonaws.com

These commands help administrators audit delegated accounts, validate service ownership, and improve visibility across multi-account AWS environments.

Official AWS References

  • AWS services that you can use with AWS Organizations
  • Delegated administrator for AWS services that work with Organizations
  • AWS CLI: list-delegated-administrators
  • AWS CLI: list-delegated-services-for-account