Amazon Cognito vs Microsoft Entra External ID.
Last verified 2026-08-19
When Amazon Cognito wins
- Native AWS IAM-mapped tokens for S3, DynamoDB, and Lambda, no app-layer translation
- Lambda triggers are the more battle-tested extension model for AWS shops
- Broader SDK coverage across Java, .NET, C++, and mobile
- The default CIAM when the rest of the architecture is already AWS
When Microsoft Entra External ID wins
- Lower TCO at 100k MAU and above in our standard-assumption bands
- Microsoft 365, Conditional Access, and Sentinel in the same security graph
- Stronger multi-tenancy and progressive profiling than Cognito user-pool groups
- Push MFA and step-up auth; Cognito is partial on step-up and has no push MFA
- The successor path for Azure AD B2C, with High Scale Compatibility mode for large migrations
Both win
- Both have FedRAMP High, PCI DSS Level 1, HIPAA, ISO 27001, and a 50k MAU free tier
- Both support WebAuthn passkeys natively; orchestration is thin on both (Cognito 2/5, Entra 3/5)
- Both support social login at scale
- Both trail Auth0 / Clerk / Stytch on developer velocity
Pricing comparison
| MAU band | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| 10,000 MAU | $0/mo | $0/mo |
| 100,000 MAU | $275/mo | $165/mo |
| 500,000 MAU | $2,475/mo | $1,500/mo |
| 1,000,000 MAU | $5,225/mo | $3,300/mo |
Developer experience & lock-in
Editorial 1–5 scores and migration effort, on the same axes for both. Lower migration effort is better (easier to adopt, less lock-in).
| Signal | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| DX overallDeveloper experience | 3/5 | 3/5 |
| Docs qualityDocumentation | 4/5 | 4/5 |
| Passkey orchestrationPasskey / WebAuthn depth | 2/5 | 3/5✓ |
| Adoption effortMigrating in | Involved | Involved |
| Lock-in (exit effort)Migrating out | Involved | Involved |
Enterprise readiness
Computed across the enterprise pillars from the capability matrix. See the enterprise-ready pillars.
| Pillar | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| Overall | Mostly ready · 69 | Enterprise-ready · 82 |
| Enterprise SSO | 100 | 100 |
| Directory sync (SCIM) | 0 | 15✓ |
| Organizations & tenancy | 20 | 70✓ |
| RBAC & custom roles | 65 | 90✓ |
| Audit logs & streaming | 100 | 100 |
| Compliance certifications | 100 | 100 |
| Security posture | 100 | 100 |
Side-by-side capability matrix
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| Password authentication | ✓ Yes | ✓ Yes |
| Social login | ✓ Yes | ✓ Yes |
| Magic links | ✕ No | ✕ No |
| SMS OTP | ✓ Yes | ✓ Yes |
| Email OTP | ✓ Yes | ✓ Yes |
| TOTP (authenticator app) | ✓ Yes | ✓ Yes |
| Push MFA | ✕ No | ✓ Yes |
| WebAuthn / passkeys | ✓ Yes | ✓ Yes |
| Biometric | ✓ Yes | ✓ Yes |
| Hardware security keys | ✓ Yes | ✓ Yes |
| SAML SSO | ✓ Yes | ✓ Yes |
| OIDC SSO | ✓ Yes | ✓ Yes |
| OAuth 2.0 SSO | ✓ Yes | ✓ Yes |
| Enterprise federation | ✓ Yes | ✓ Yes |
| Passwordless-only flows | ~ Partial | ~ Partial |
| Adaptive MFA | ✓ Yes | ✓ Yes |
| Step-up auth | ~ Partial | ✓ Yes |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| RBAC | ~ Partial | ✓ Yes |
| ABAC | ✓ Yes | ✓ Yes |
| ReBAC | ✕ No | ✕ No |
| FGA engine | ✕ No | ✕ No |
| API authorization | ✓ Yes | ✓ Yes |
| Fine-grained permissions | ~ Partial | ~ Partial |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| Self-service registration | ✓ Yes | ✓ Yes |
| Progressive profiling | ✕ No | ✓ Yes |
| Self-service account | ✓ Yes | ✓ Yes |
| Bulk user import | ✓ Yes | ✓ Yes |
| Admin user search | ✓ Yes | ✓ Yes |
| Custom user metadata | ✓ Yes | ✓ Yes |
| Organizations / tenants | ✕ No | ~ Partial |
| Multi-tenancy | ~ Partial | ✓ Yes |
| SCIM provisioning | ✕ No | ✕ No |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| REST API | ✓ Yes | ✓ Yes |
| GraphQL API | ✕ No | ✓ Yes |
| SDKs | 12 listed | 11 listed |
| CLI | ✓ Yes | ✓ Yes |
| Terraform provider | ✓ Yes | ✓ Yes |
| Local emulator | ~ Partial | ✕ No |
| Extension model | Lambda triggers (pre-sign-up, post-confirmation, custom auth challenge) | Azure Functions + Custom policies (External Identities) |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| Bot detection | ✓ Yes | ✓ Yes |
| Breached password detection | ✓ Yes | ✓ Yes |
| Brute-force protection | ✓ Yes | ✓ Yes |
| Anomaly detection | ✓ Yes | ✓ Yes |
| Log streams | ✓ Yes | ✓ Yes |
| Audit logs | ✓ Yes | ✓ Yes |
| GDPR data export | ✓ Yes | ✓ Yes |
| PII minimization | ~ Partial | ~ Partial |
| Post-quantum roadmap | ~ Partial | ~ Partial |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| MCP support | ✕ No | ~ Partial |
| OAuth 2.1 | ~ Partial | ✓ Yes |
| Dynamic client registration | ✕ No | ✓ Yes |
| Agent vs human token separation | ✕ No | ~ Partial |
| Web Bot Auth | ✕ No | ✕ No |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| SOC 2 Type II | ✓ Yes | ✓ Yes |
| ISO 27001 | ✓ Yes | ✓ Yes |
| ISO 27018 | ✓ Yes | ✓ Yes |
| HIPAA | ✓ Yes | ✓ Yes |
| PCI DSS | Level 1 | Level 1 |
| GDPR | ✓ Yes | ✓ Yes |
| CCPA | ✓ Yes | ✓ Yes |
| FedRAMP | High | High |
| EU data residency | ✓ Yes | ✓ Yes |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| Consent management | ✕ No | ~ Partial |
| Preference center | ✕ No | ~ Partial |
| Purpose-specific consent | ✕ No | ✕ No |
| Integrates with CMPs | n/a | n/a |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| Multi-region deployment | ✓ Yes | ✓ Yes |
| Data residency control | ✓ Yes | ✓ Yes |
| Proven at high scale (1M+ MAU) | ✓ Yes | ✓ Yes |
| Capability | Amazon Cognito | Microsoft Entra External ID |
|---|---|---|
| Password-hash import | ~ Partial | ~ Partial |
| Lazy / just-in-time migration | ✓ Yes | ✓ Yes |
| Account linking & dedup | ~ Partial | ~ Partial |
| Custom domains per brand | ~ Partial | ~ Partial |
| Per-brand theming of all flows | ~ Partial | ~ Partial |
| Per-brand consent partitioning | ✕ No | ✕ No |
| Deletion webhooks / cascade | ✓ Yes | ✓ Yes |
| Event streaming / webhooks | ✓ Yes | ✓ Yes |
| Documented rate limits | ✓ Yes | ✓ Yes |
FAQ
- Did Azure AD B2C shut down on 15 March 2026?
- No. That date retired Azure AD B2C Premium P2 (Identity Protection) for all customers. Microsoft has committed to supporting remaining Azure AD B2C P1 tenants until at least May 2030. The platform is frozen. New work belongs on Entra External ID. Cognito is unrelated to that timeline.
- Which is cheaper, Cognito or Entra External ID?
- Entra, at the bands we model. Both are free at 10k MAU. At 100k MAU our estimates are about $275/month for Cognito vs $165/month for Entra; at 1M MAU about $5,225 vs $3,300. Advanced Security Features on Cognito and P1/P2 add-ons on Entra move those numbers. Always confirm with a quote at your scale.
- Does Cognito have Organizations like Auth0?
- Not first-class. Multi-tenant SaaS on Cognito is typically user-pool groups, claims, and Lambda triggers. Entra External ID is better here (multi-tenancy is true, Organizations are partial) but still behind WorkOS, Frontegg, or Auth0 Organizations. If B2B tenancy is the product, do not pick a hyperscaler to save on login.
- Should I switch from Cognito to Entra External ID?
- Only if you are leaving AWS or already standardized on Microsoft 365 / Azure. Switching hyperscalers to save a few hundred dollars a month rarely pays back the IAM-token and trigger rewrite. Stay on Cognito if the app is AWS-native. Move to Entra if you are an Azure AD B2C customer whose P2 just disappeared and whose P1 tenant is frozen.
This is a cloud-alignment decision, not a feature bake-off. Cognito is AWS identity for customers. Entra External ID is Microsoft identity for customers. The boolean matrix will tell you Entra has more checkboxes. That is true and still not why most teams pick one.
Choose Cognito when tokens need to authorize AWS resources directly, or FedRAMP High on AWS GovCloud is the constraint. Choose Entra External ID when Conditional Access and Sentinel are already the security graph, or you are migrating off Azure AD B2C.
Do not pick either for passkey conversion or B2B Organizations. For those, look at Stytch, Descope, Clerk, or WorkOS.
Profiles: Amazon Cognito, Microsoft Entra External ID. B2C timeline: Entra profile.