A security administrator needs to restrict use of root user credentials across member accounts in an AWS Organizations organization. All features are enabled. The management account is used only for billing and administration, not for operations. How can the administrator restrict member account root user usage across the organization?

Service control policies (SCPs) are a feature of AWS Organizations that allow you to manage permissions in your organization. They can be used to restrict the actions that users and roles in member accounts can perform, including the root user. By creating an Organizational Unit (OU), attaching an SCP that explicitly denies actions for the root user, and then moving all member accounts into this OU, the administrator can effectively restrict root user usage across the organization. The other options are less effective: Disabling the root user at the organization root is not possible; the root user is fundamental. Enabling MFA for the root user is a good security practice but doesn't restrict its capabilities. IAM user policies apply to IAM users and roles, not the root user itself. CloudTrail and CloudWatch Logs integration with a metric filter helps monitor root user activity but does not prevent or restrict its usage.