Amazon Web Services → Microsoft Azure
Azure equivalent of Amazon Cognito
Amazon Cognito user pools map to Microsoft Entra External ID in an external tenant.
About Amazon Cognito
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Customer identity for apps. User pools handle sign-up, sign-in, MFA, federation (social, SAML, OIDC), and managed login. Identity pools exchange tokens for temporary AWS credentials. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Customer identity and access management (CIAM) | Microsoft Entra External ID | Partial match |
Customer identity, directories & app access(1)
Customer identity and access management (CIAM) Partial match
Amazon Cognito user pools map to Microsoft Entra External ID in an external tenant. Azure AD B2C, the older Azure CIAM service, has been unavailable to new customers since May 1, 2025. Cognito identity pools, which swap tokens for AWS credentials, have no direct Azure counterpart.
- Platform. Cognito is a standalone AWS service. External ID runs on the same Microsoft Entra platform as workforce identity, in a separate external tenant, and also covers B2B guest collaboration in workforce tenants.
- Customization. Cognito uses managed login pages, Lambda triggers, and custom auth flows. External ID uses customizable user flows, custom authentication extensions, and branding. Azure AD B2C custom policies (Identity Experience Framework) don't carry over.
- AWS access. Identity pools give app users temporary AWS credentials for S3 or DynamoDB. On Azure, apps usually call their own API, which then uses a managed identity.