[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Access management > Assigning a user as an organization administrator

# Assigning a user as an organization administrator

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.
  
  1. In the left-hand panel, select ![persons-lock](../../_assets/console-icons/persons-lock.svg) **Access bindings**.

  1. At the top right, click **Assign roles**.

  1. Select the user you want to assign as an administrator. If required, use the search bar.

  1. Click ![plus](../../_assets/console-icons/plus.svg) **Add role** and select [`organization-manager.admin`](../../iam/roles-reference.md#organization-manager-admin).

  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  1. [Get the user ID](users-get.md).

  1. Assign the [role](../../iam/concepts/access-control/roles.md) using this command:

      ```bash
      yc organization-manager organization add-access-binding <organization_name_or_ID> \
        --role <role_ID> \
        --subject userAccount:<user_ID>
      ```

      Where: 
      
      * `--role`: Role ID. Specify the `organization-manager.admin` role.
      * `--subject`: User ID.

      For example, this command assigns the administrator role for the organization with the `bpf3crucp1v2********` ID:

      ```bash
      yc organization-manager organization add-access-binding bpf3crucp1v2******** \
        --role organization-manager.admin \
        --subject userAccount:aje6o61dvog2********
      ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Describe the parameters of the [roles](../../iam/concepts/access-control/roles.md) you assign in the configuration file:

      ```hcl
      resource "yandex_organizationmanager_organization_iam_binding" "org_admin_role" {
        organization_id = "<organization_ID>"
        role = "<role_ID>"
        members = [
          "userAccount:<user_ID>",
        ]
      }
      ```

      Where:

      * `organization_id`: [Organization ID](organization-get-id.md).
      * `role`: Specify the `organization-manager.admin` role. For each role, you can only use one `yandex_organization manager_organization_iam_binding` resource.
      * `userAccount:<user_ID>`: ID of the user Yandex account.

      For more information about the resources you can create with Terraform, see [this provider guide](../../terraform/index.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.
     
  The user will thus be assigned the organization administrator role. You can check the role in the [Cloud Center interface](https://center.yandex.cloud/organization).

- API {#api}

  Use the REST API method [updateAccessBindings](../api-ref/Organization/updateAccessBindings.md) for the [Organization](../api-ref/Organization/index.md) resource or the gRPC API call [OrganizationService/UpdateAccessBindings](../api-ref/grpc/Organization/updateAccessBindings.md) and provide the following in the request:

  * The `organization-manager.admin` [role](../../iam/roles-reference.md#organization-manager-admin) ID in the `roleId` parameter for REST API or `role_id` for gRPC API.
  * User ID and type in the `subject` section.

{% endlist %}

#### See also {#see-also}

* [Setting up service account access permissions](../../iam/operations/sa/set-access-bindings.md)
* [Setting up cloud access permissions](../../resource-manager/operations/cloud/set-access-bindings.md)
* [Setting up folder access permissions](../../resource-manager/operations/folder/set-access-bindings.md)