I Tried Applying to an Existing Organization the Equivalent of the Leave-Prevention SCP That Is Applied by Default in AWS Organizations
This page has been translated by machine translation. View original
Introduction
On July 10, 2026, AWS announced an update under which AWS Organizations applies, by default, an SCP that prevents accounts from leaving to new organizations created from the console.
The changes in this update are as follows.
| Item | Before | Now |
|---|---|---|
| When creating a new organization in the console | No automatic SCP application | An SCP that denies organizations:LeaveOrganization and account:CloseAccount is automatically applied to the root |
| Scope | — | Only new organizations created via the console (CLI/SDK/CloudFormation are not covered) |
| Impact on existing organizations | — | None (only organizations newly created in the console on or after June 30, 2026) |
| Changing/disabling | — | Users can do so at any time |
The content of the automatically applied SCP is as follows.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyLeaveOrganizationAndCloseAccount",
"Effect": "Deny",
"Action": [
"organizations:LeaveOrganization",
"account:CloseAccount"
],
"Resource": "*"
}
]
}
The regions listed in What's New are US East (N. Virginia), AWS GovCloud (US-East / US-West), and China (Beijing / Ningxia). Because the Organizations API endpoint is in us-east-1, you do not need to be conscious of the region for normal use in the commercial partition.
In this article, I manually apply a setting equivalent to this SCP to an existing Organization and confirm that leaving from a member account is denied.
Verification
Verification environment
| Item | Value |
|---|---|
| Management account | 111122223333 |
| Member account | 444455556666 |
| Organization ID | o-exampleorgid |
| Root ID | r-exrt |
| Region | us-east-1 |
Creating the SCP
From the management account, I create an SCP with the same content as the one applied by default.
aws organizations create-policy \
--name DenyLeaveOrganizationAndCloseAccount \
--description "Deny member accounts from leaving the organization or closing themselves" \
--type SERVICE_CONTROL_POLICY \
--content '{"Version":"2012-10-17","Statement":[{"Sid":"DenyLeaveOrganizationAndCloseAccount","Effect":"Deny","Action":["organizations:LeaveOrganization","account:CloseAccount"],"Resource":"*"}]}' \
--region us-east-1
The policy was created.
{
"Policy": {
"PolicySummary": {
"Id": "p-examplepolicy",
"Arn": "arn:aws:organizations::111122223333:policy/o-exampleorgid/service_control_policy/p-examplepolicy",
"Name": "DenyLeaveOrganizationAndCloseAccount",
"Description": "Deny member accounts from leaving the organization or closing themselves",
"Type": "SERVICE_CONTROL_POLICY",
"AwsManaged": false
}
}
}
Attaching to the root
I attach the created SCP to the root of the Organization.
aws organizations attach-policy \
--policy-id p-examplepolicy \
--target-id r-exrt \
--region us-east-1
It completed successfully (no output).
Attempting to leave from the member account
I switch to the member account (444455556666) with AssumeRole and run leave-organization.
aws sts assume-role \
--role-arn arn:aws:iam::444455556666:role/OrganizationAccountAccessRole \
--role-session-name scp-verification \
--region us-east-1
Using the obtained credentials, I try to leave the organization.
aws organizations leave-organization --region us-east-1
It was denied with the following error.
An error occurred (AccessDeniedException) when calling the LeaveOrganization operation: You don't have permissions to access this resource.
The OrganizationAccountAccessRole used for the verification has permissions equivalent to AdministratorAccess, so this is not due to insufficient IAM policy permissions. This error is caused by the explicit Deny of the SCP attached to the root, and I was able to confirm that the member account cannot leave the organization.
Cleanup
Now that the verification is complete, I detach and delete the SCP.
aws organizations detach-policy \
--policy-id p-examplepolicy \
--target-id r-exrt \
--region us-east-1
aws organizations delete-policy \
--policy-id p-examplepolicy \
--region us-east-1
Both completed successfully.
Summary
With this update, an SCP that denies member accounts from leaving or closing is now enabled by default in Organizations newly created from the console. It is not automatically applied to organizations created via the CLI or SDK, or to existing Organizations, so you can apply an equivalent control by manually creating an SCP with the same content and attaching it to the root.
In the verification in this article, I ran organizations:LeaveOrganization from a role with permissions equivalent to AdministratorAccess and confirmed that it was denied by the explicit Deny of the SCP. Note that the same SCP definition also includes a deny for account:CloseAccount, but verifying the behavior of account closure operations is outside the scope of this article.
The SCP attachment limit was expanded from 5 to 10 in May 2026, which also leaves room to apply additional SCPs. For new Organizations, keep the default application, and for existing Organizations as well, I recommend an equivalent setting if you have room in your quota.
References
