# Register a delegated administrator member account
<a name="stacksets-orgs-delegated-admin"></a>

In addition to your organization's management account, member accounts with delegated administrator permissions can create and manage StackSets with service-managed permissions for the organization. StackSets with service-managed permissions are created in the management account, including StackSets created by delegated administrators. To be registered as a delegated administrator for your organization, your member account must be in the organization. For more information about joining an organization, see [Inviting an AWS account to join your organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.html).

Your organization can have up to five registered delegated administrators at one time. Delegated administrators can choose to deploy to all accounts in your organization or specific OUs. Trusted access with AWS Organizations must be activated before delegated administrators can deploy to accounts managed by Organizations. For more information, see [Activate trusted access for StackSets with AWS Organizations](stacksets-orgs-activate-trusted-access.md).

**Important**  
Please be aware of the following:  
Delegated administrators have full permissions to deploy to accounts in your organization. The management account can't limit delegated administrator permissions to deploy to specific OUs or to perform specific StackSet operations.
Make sure your delegated administrators have `organizations:ListDelegatedAdministrators` permissions to avoid any potential errors.

You can register delegated administrators for your organization in the following Regions: US East (Ohio), US East (N. Virginia), US West (N. California), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), Israel (Tel Aviv), South America (São Paulo), AWS GovCloud (US-East), and AWS GovCloud (US-West).

You can register and deregister delegated administrators using the [CloudFormation console](https://console.aws.amazon.com/cloudformation/), [AWS CLI](https://aws.amazon.com/cli/), or [AWS SDKs](https://aws.amazon.com/developer/tools/).

## To register a delegated administrator (console)
<a name="stacksets-orgs-register-delegated-admin-console"></a>

1. Sign in to AWS as an administrator of the management account and open the CloudFormation console at [https://console.aws.amazon.com/cloudformation/](https://console.aws.amazon.com/cloudformation/).

1. From the navigation pane, choose **StackSets**.

1. Under **Delegated administrators**, choose **Register delegated administrator**.

1. In the **Register delegated administrator** dialog box, choose **Register delegated administrator**.

   The success message indicates that the member account has successfully been registered as a delegated administrator.

## To deregister a delegated administrator (console)
<a name="stacksets-orgs-deregister-delegated-admin-console"></a>

1. Sign in to AWS as an administrator of the management account and open the CloudFormation console at [https://console.aws.amazon.com/](https://console.aws.amazon.com/).

1. From the navigation pane, choose **StackSets**.

1. Under **Delegated administrators**, select the account that you want to deregister, and then choose **Deregister**.

   The success message indicates that the member account has successfully been deregistered as a delegated administrator.

   You can register this account again at any time.

## To register a delegated administrator (AWS CLI)
<a name="stacksets-orgs-register-delegated-admin-cli"></a>

1. Open the AWS CLI.

1. Run the `register-delegated-administrator` command.

   ```
   $ aws organizations register-delegated-administrator \
     --service-principal=member.org.stacksets.cloudformation.amazonaws.com \
     --account-id="memberAccountId"
   ```

1. Run the `list-delegated-administrators` command to verify that the specified member account is successfully registered as a delegated administrator.

   ```
   $ aws organizations list-delegated-administrators \
     --service-principal=member.org.stacksets.cloudformation.amazonaws.com
   ```

## To deregister a delegated administrator (AWS CLI)
<a name="stacksets-orgs-deregister-delegated-admin-cli"></a>

1. Open the AWS CLI.

1. Run the `deregister-delegated-administrator` command.

   ```
   $ aws organizations deregister-delegated-administrator \
     --service-principal=member.org.stacksets.cloudformation.amazonaws.com \
     --account-id="memberAccountId"
   ```

1. Run the `list-delegated-administrators` command to verify that the specified member account is successfully deregistered as a delegated administrator.

   ```
   $ aws organizations list-delegated-administrators \
     --service-principal=member.org.stacksets.cloudformation.amazonaws.com
   ```

   You can register this account again at any time.