How do I disable Cognito MFA for existing users?

1. Verify User Pool-Level MFA Settings Open the Amazon Cognito console. Select the User Pools option and click on your user pool. Navigate to MFA and verifications under the Sign-in experience section. Ensure that No MFA is selected. If not, select it and save the changes.
2. Inspect Individual User Attributes Go to the Users and Groups tab within your user pool. Search for the specific user experiencing MFA challenges. Click on the username to open the user's details. Look for the following attributes: preferred_mfa_setting: This shows the user's preferred MFA method. user_mfa_setting_list: This lists all MFA methods enabled for the user.
3. Clear MFA Settings for a User Within the user details, locate the MFA section. Disable any MFA settings by clearing or removing them (e.g., SMS or TOTP-based MFA).
4. Optional: Remove Phone Number If the user had SMS-based MFA configured: Under Attributes, look for the phone_number and phone_number_verified attributes. Edit the attributes to: Clear the phone_number field. Set phone_number_verified to false.

This occurs even if MFA is disabled at both the pool and user levels.

Why This Happens

When Cognito Advanced Security is enabled, it monitors sign-in activity for risks like:

1. Unusual Login Behavior: Such as login from an unknown device, IP, or location.
2. Risk Detection: Identifying potential account takeover attempts based on behavior analysis.
3. Enforcing Extra Challenges: For high-risk events, Cognito enforces an additional layer of security, such as SMS MFA, even if MFA is disabled.

Steps to Resolve

1. Check Advanced Security Settings

1. Open the Cognito Console.
2. Select your User Pool.
3. Go to Advanced security under the App integration section.
4. Verify the Risk detection and Security settings. Look for:
   • Risk-Based Challenges: This setting may be configured to require challenges for high-risk events.
   • Challenge Response: For high-risk assessments, SMS MFA might still be triggered.

2. Adjust Advanced Security Settings

If you don’t want SMS MFA to be enforced:

1. Under Advanced security settings, change the configuration:
   • For Risk-based challenges, set the response for "High Risk" to Allow (instead of "Challenge").
2. Save the changes.

3. Investigate Risk Level Causes

Review why the login attempt is being flagged as "High Risk" in the event history:

• IP Address: If the login comes from an unusual or suspicious IP, it may trigger the risk.
• Device: If the user is logging in from a new or unknown device, Cognito may flag it.
• Geolocation: Logins from a new or unexpected region may be considered risky.

If these scenarios are expected for your test accounts:

1. Whitelist Trusted IPs: Add IP addresses or ranges for testing systems under Advanced security settings.
2. Test with Known Devices: Use the same devices to prevent triggering "new device" flags.

4. Test Again

After making these changes:

• Attempt to log in as the user again.
• Check the User Event History to ensure the risk assessment is no longer flagged as "High."

These steps should help eliminate unwanted SMS MFA challenges while maintaining a balance of security and usability in your Cognito configuration.

Try from Same IP Address if it persists Contact AWS Support