Cognito - Allow user to select MFA option through managed login

Question

*I want to allow users on creation to select whatever MFA option they desire. *

We create users through the `AdminCreateUserRequest` with just name, email, and email_verified.

The user will get their `Your temporary password` email where they will login to our application. It will get them to reset their password, and then force email MFA on to them.

For the past 2 years, it was allowing them to select the MFA option they want, which seems to be unusable anymore?

My client settings:
**Sign-In Multi-Factor authentication options:**
MFA enforcement - Require MFA 
MFA Methods - SMS, Authenticator apps, Email message

I would also love to know how to reset APP based MFA ~ but beggars can't be choosers.

re:Post Agent · Answer

Based on the information provided, it appears that the behavior you're experiencing with Amazon Cognito's managed login has changed. Currently, when email MFA is enabled, it is automatically enforced as the default and only MFA method, bypassing the MFA selection screen entirely. This is part of Cognito's design, where email MFA is treated as a required verification method rather than an optional MFA choice.

To allow users to select their preferred MFA option during the managed login process, you'll need to adjust your configuration. Here are some recommendations:

1. Disable Email MFA in your Cognito user pool settings.
2. Enable only SMS and/or TOTP (authenticator app) as MFA options.

This configuration will allow users to choose their preferred MFA method during the sign-up or first login process.

If you still want to maintain email verification while allowing MFA flexibility, you can:

1. Implement email verification during the sign-up process.
2. Configure SMS and/or TOTP as MFA options.

This approach provides both email verification and MFA flexibility.

Regarding resetting APP-based MFA (TOTP), this typically requires administrative intervention. As an administrator, you can reset a user's MFA settings using the AWS SDK or CLI. The process involves:

1. Disassociating the existing software token MFA for the user.
2. Allowing the user to set up a new software token MFA.

Keep in mind that implementing custom MFA selection flows may require additional development on your part, including creating a user interface for initiating and managing the MFA change process, handling potential errors, and ensuring a smooth user experience throughout the transition.

It's important to note that the behavior you observed in the past two years seems to have changed due to updates in Cognito's managed login flow. Always refer to the latest AWS documentation for the most up-to-date information on Cognito's features and behaviors.
      
**Sources**  
[Email MFA is only way for all users after enable Email MFA | AWS re:Post](https://repost.aws/questions/QU1ag4RPeoQjCfkmwfKQJN9Q/email-mfa-is-only-way-for-all-users-after-enable-email-mfa)  
[How can users enable MFA in Cognito hosted sign in? | AWS re:Post](https://repost.aws/questions/QUk4GvzrM0QZCY6F59AJz1tw/how-can-users-enable-mfa-in-cognito-hosted-sign-in)  
[Configure authentication methods for managed login - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flows-selection-managedlogin.html)

Cognito - Allow user to select MFA option through managed login

Add your answer

Relevant content