Transfer organization management account

The AWS Organization is a resource that exists in the account in which it is created, the same way that other AWS resources function. It cannot be moved into another account. The delegation feature in AWS Organizations mentioned earlier in this discussion is a resource-based policy construct, similar to how an S3 bucket policy can grant some degree of access to a principal in another account. However, delegating limited access in that manner doesn't transfer the resource that is either an AWS Organization or an S3 bucket to another account.

The management account of an AWS Organization is the single special account to which the otherwise significant power that the management account commands does not extend, by design. In particular, an authorised user or role in the management account can change the root email address of any member account, but that isn't possible for the management account as the target.

The simplest option would be for your report to hand over the account voluntarily by changing the account's root email address to an appropriate, non-personal mailbox dedicated for use as the account's root email: https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-root-user.html

If they aren't cooperating or available to assist, another alternative would be to catch the emails sent to the current root email, if your local legislation allows doing so in your situation. If it does, you should first change the primary contact phone number and email to ones you have access to: https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-primary.html. Next, if the root user is secured with MFA and none of the MFA devices are (or the only one isn't) available, you'll need to be able to receive emails AWS sends to the current root email address (the primary contact email will not suffice) and phone calls to the primary contact phone number. Recover MFA access according to these instructions: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html#root-mfa-lost-or-broken. Once MFA is reset or if there was no MFA configured, reset the root password as instructed here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reset-root-password.html

Once you're in as root, you can change the root email and other details in the same way as above in the case where the person was cooperating.

If none of the above is possible, the only way to transfer the AWS Organization to a new account is to create an entirely new AWS Organization in a different account and have each member account leave the old organisation and join the new one. Everything configured in your current organisation (such as SCPs, AWS Backup policies, cost anomaly detection configurations, etc.), integrated with it (like CloudTrail, Security Hub, GuardDuty, Security Lake), or dependent on it (like IAM policies using the organisation ID or organisational unit paths to control permissions) would have to be rebuilt or reconfigured. It might also have financial implications, such as by Enterprise Discount Program discounts or Private Pricing Agreements potentially being linked to your current org or management/billing account.