AWS OIDC Integration with Azure AD – Multi-Tenant Support Limitation

You're correct about the limitation with AWS Cognito and multi-tenant Azure AD integration. This is indeed a known limitation in AWS Cognito's current implementation.

The core issue is that when using the multi-tenant endpoints like "https://login.microsoftonline.com/common/v2.0", Microsoft returns tokens with tenant-specific issuer URLs (in the format "https://login.microsoftonline.com/{tenant_id}/v2.0"). However, Cognito expects the issuer in the token to match exactly what was configured. This mismatch causes validation failures when users from different tenants attempt to authenticate.

AWS has acknowledged this limitation, and there is an internal feature request with the Cognito team to support multi-tenancy when integrating with Microsoft's common endpoint. Unfortunately, there's no published ETA for when this feature will become available, as AWS doesn't typically share details about their development roadmap publicly.

In the meantime, here are some potential workarounds:

1. Create separate identity providers in Cognito for each tenant you need to support. This works but becomes unwieldy as you add more tenants.

2. Develop a custom identity provider that acts as a proxy between your application and Azure AD, handling the dynamic issuer claims.

3. Use AWS IAM federation with SAML 2.0 instead of OIDC if your requirements allow for it. This approach might provide more flexibility for multi-tenant scenarios.

4. Consider using AWS IAM Identity Center with different configurations. While IAM Identity Center also has limitations with multiple IdPs, you could explore account-specific identity provider configurations.

For the most up-to-date information on this feature, I'd recommend keeping an eye on the AWS "What's New" page and the Official AWS Blog for announcements about new features and improvements to Cognito's identity provider capabilities.
Sources
Cognito Social Login - Allow Microsoft Personal Accounts and Multi-tenant Access | AWS re:Post
Infrastructure OU - Shared Services account - AWS Prescriptive Guidance