«The organization must keep at least one active administrator.» (last_active_admin)

Symptom

When suspending, demoting or erasing an administrator account, «The organization must keep at least one active administrator.» or «The last active administrator account cannot be deleted.» appears. The API answers 409 last_active_admin. Over SCIM, disabling the last administrator also gives 409.

Cause

The change would leave the organization with no active administrator. Without administrators, nobody could manage the organization or recover access.

Fix

1. Create another administrator account, or promote an existing person to «Administrator».
2. Ask that person to sign in and create their passkey.
3. Repeat the change on the original account.

Good practice

Always keep at least two active administrators, each with a passkey (and preferably an approver phone). The «Finish setup» card under «Manage» › «Organization» reminds you with «Second administrator with a passkey».

When to escalate

If the only administrator lost every factor and there is no other, the console cannot recover them: contact your provider.