Cognito: Passing Additional Query Parameters to IDP for Authentication Request (prompt=select_account)

You're correct that the ability to pass additional query parameters like 'prompt=select_account' to the identity provider (IdP) during the authentication request is not directly supported in Amazon Cognito's current configuration options for SAML providers.

This limitation is indeed a known issue and has been the subject of multiple feature requests from users. The ability to customize the authentication request by passing additional parameters would provide more flexibility in scenarios like yours, where you want to allow users to switch accounts easily.

While Amazon Cognito offers robust support for SAML-based authentication, including the ability to federate with SAML identity providers like Azure, the current implementation doesn't provide a straightforward way to modify the SAML request with custom parameters.

As an AWS service, Cognito is continuously evolving based on customer feedback and needs. However, the timeline for implementing new features can vary based on multiple factors, including complexity, demand, and overall impact on the service.

In the meantime, there are a few potential workarounds you might consider, though they may not be ideal:

1. You could implement a custom authentication flow using Lambda triggers, which might allow you to intervene in the authentication process. However, this approach would be complex and may not fully solve the issue.

2. Another option might be to handle the account switching logic in your application, perhaps by signing the user out and initiating a new sign-in process when they want to switch accounts.

3. You could also consider implementing your own SAML authentication flow outside of Cognito, which would give you more control over the parameters sent to Azure, but this would mean losing some of the benefits of using Cognito.

It's worth noting that while this feature isn't currently available, AWS does take customer feedback seriously. Continuing to voice this need through official AWS channels, such as reaching out to AWS support or your account representative, can help emphasize the importance of this feature to the Cognito team.

For now, unfortunately, there isn't a simple built-in solution to pass the 'prompt=select_account' parameter through Cognito to Azure. This remains a limitation of the current implementation that many users are hoping to see addressed in future updates to the service.
Sources
Using SAML identity providers with a user pool - Amazon Cognito
SAML session initiation in Amazon Cognito user pools - Amazon Cognito
Authentication flows - Amazon Cognito