Change prefered auth method of cognito managed login

In Amazon Cognito with managed login, when you have multiple authentication methods enabled (password, email OTP, and passkeys), you can control the preferred authentication method during sign-in.

For custom-built applications using AWS SDKs, you can specify a preferred challenge in your authentication request. When using the USER_AUTH flow, you can add a "PREFERRED_CHALLENGE" parameter to your AuthParameters. For example, you could set "PREFERRED_CHALLENGE": "PASSWORD" to prioritize password authentication.

For managed login pages, Amazon Cognito automatically makes your configured authentication options available on the sign-in pages. If you're finding that email OTP is being triggered immediately instead of showing password as the default option, you may need to adjust your user pool configuration.

You can manage authentication methods in your user pool by:

1. Signing in to AWS and navigating to the Amazon Cognito user pools console
2. Selecting your user pool
3. Going to the "Sign-in" menu
4. Locating "Options for choice-based sign-in" and choosing "Edit"
5. Configuring your authentication preferences

Additionally, users can set their own MFA preferences using the SetUserMFAPreference operation, which allows them to activate or deactivate different MFA factors and set one as preferred. The preferred MFA factor will be used to authenticate a user if multiple factors are activated.
Sources
Authentication flows - Amazon Cognito
Manage authentication methods in AWS SDKs - Amazon Cognito
SetUserMFAPreference - Amazon Cognito User Pools
Authentication with Amazon Cognito user pools - Amazon Cognito