Cognito costs seem high for a few users

Based on your description, you should indeed be within the free tier for Amazon Cognito user pools, which includes 10,000 monthly active users (MAUs) for users who sign in directly or via social identity providers.

There are a few possible explanations for the charges you're seeing:

1. Machine-to-Machine (M2M) authorization: If you're using client credentials grants for machine-to-machine authorization, these are charged separately and don't fall under the free tier. M2M authorization is charged per app client and per successful token response.

2. API request rates: If you've purchased additional capacity above the default quotas for certain user pool APIs, this would incur additional charges.

3. Dependent services: Features like email messages sent through Amazon SES or Lambda triggers can incur costs in those dependent services, even if your Cognito usage is within the free tier.

4. SAML/OIDC federation: While you mentioned you're not using this, it's worth double-checking as these authentications have a smaller free tier (only 50 MAUs).

5. Feature plan: You might be using the Essentials or Plus tier features that have associated costs beyond the free tier.

To better understand your charges, I recommend checking the AWS Billing and Cost Management console, which should provide a more detailed breakdown of your Cognito usage. You can also monitor API request rates using the Utilization metric in the Service Quotas console.

If you're still unsure about the charges after reviewing these areas, contacting AWS Support would be the best next step as they can provide specific details about the charges on your account.
Sources
Amazon Cognito - Pricing
Monitoring and managing costs - Amazon Cognito
User pool feature plans - Amazon Cognito
Aws Cognito Bill | AWS re:Post