Resource Management:Manage delegated administrator accounts

What is a delegated administrator account?

The Resource Directory management account can designate a member as a delegated administrator for a trusted service. The delegated administrator can then access organization and member information and perform administrative tasks across the organization. Trusted services that support delegated administrator accounts.

This separation lets the management account focus on Resource Directory governance while delegated administrators handle trusted service management, aligning with security best practices.

Limitations

• Only specific trusted services support delegated administrator accounts. Supported trusted services.

• Only the Resource Directory management account, or a RAM user or RAM role within that account that has the following permissions, can add or remove delegated administrator accounts.

  {
      "Version": "1",
      "Statement": [{
          "Action": [
              "resourcemanager:RegisterDelegatedAdministrator",
              "resourcemanager:DeregisterDelegatedAdministrator"
          ],
          "Resource": "*",
          "Effect": "Allow"
      }]
  }

  Create a custom policy.

• You cannot designate the management account as a delegated administrator account.

• Each trusted service defines the maximum number of delegated administrator accounts you can add.

Add a delegated administrator account

1. Log on to the Resource Management console with your management account.

2. In the navigation pane on the left, choose Resource Directory > Trusted Services.

3. On the Trusted Services page, find the trusted service and click Manage in the Actions column.

4. In the Delegated Administrator Account section, click Add.

5. In the Add Delegated Administrator Account panel, select a member.

6. Click OK.

   You can now access the multi-account management module of the trusted service and perform administrative operations across your organization.

Remove a delegated administrator account

1. Log on to the Resource Management console with your management account.

2. In the navigation pane on the left, choose Resource Directory > Trusted Services.

3. On the Trusted Services page, find the trusted service and click Manage in the Actions column.

4. In the Delegated Administrator Account section, find the account to remove and click Remove in the Actions column.

5. In the Remove Delegated Administrator Account dialog box, click OK.

   The removed account can no longer access Resource Directory organization and member information through the trusted service.