Customer identity, directories & app access
Amazon Cognito vs Microsoft Entra External ID
Amazon Cognito user pools map to Microsoft Entra External ID in an external tenant.
Azure AD B2C, the older Azure CIAM service, has been unavailable to new customers since May 1, 2025. Cognito identity pools, which swap tokens for AWS credentials, have no direct Azure counterpart.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | Amazon Cognito | Microsoft Entra External ID |
| Lifecycle | Generally available | Azure AD B2C, the previous customer identity service, has been unavailable to new customers since May 1, 2025. Existing B2C tenants remain supported. |
| What it is | Customer identity for apps. User pools handle sign-up, sign-in, MFA, federation (social, SAML, OIDC), and managed login. Identity pools exchange tokens for temporary AWS credentials. | Customer and partner identity. External tenants handle consumer and business-customer sign-up and sign-in with social and enterprise IdPs, and B2B collaboration handles guest access in workforce tenants. |
| Pricing model | Per monthly active user, by feature plan (Lite, Essentials, Plus), with a free tier, plus SMS and advanced security charges. | Per monthly active user, with a free tier, plus add-ons (such as SMS MFA). |
| Docs | Amazon Cognito docs | Microsoft Entra External ID docs |
| Pricing page | Amazon Cognito pricing | Microsoft Entra External ID pricing |
| Exams | DVA-C02 Retiring SCS-C03 SAA-C03 | SC-300 AI-200 |
Key differences
- Platform. Cognito is a standalone AWS service. External ID runs on the same Microsoft Entra platform as workforce identity, in a separate external tenant, and also covers B2B guest collaboration in workforce tenants.
- Customization. Cognito uses managed login pages, Lambda triggers, and custom auth flows. External ID uses customizable user flows, custom authentication extensions, and branding. Azure AD B2C custom policies (Identity Experience Framework) don't carry over.
- AWS access. Identity pools give app users temporary AWS credentials for S3 or DynamoDB. On Azure, apps usually call their own API, which then uses a managed identity.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per monthly active user, by feature plan (Lite, Essentials, Plus), with a free tier, plus SMS and advanced security charges. Amazon Cognito pricing →
- Azure
- Per monthly active user, with a free tier, plus add-ons (such as SMS MFA). Microsoft Entra External ID pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Developer – Associate DVA-C02 | AWS | Associate | retiring Being updated to DVA-C03. Registration for DVA-C03 opens Oct 27, 2026. Last day to take DVA-C02 is Nov 30, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| Microsoft Certified – Identity and Access Administrator Associate SC-300 | Azure | Associate | current English version will be updated on Oct 28, 2026. |
| Microsoft Certified – Azure AI Cloud Developer Associate AI-200 | Azure | Associate | current Back-end services, containers, and architecture for AI solutions on Azure. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
Verification notes
- Azure AD B2C is closed to new customers (since May 1, 2025), but existing tenants are still supported. Plan new apps on Entra External ID.
FAQ
What is the Azure equivalent of Amazon Cognito?
Amazon Cognito user pools map to Microsoft Entra External ID in an external tenant. Azure AD B2C, the older Azure CIAM service, has been unavailable to new customers since May 1, 2025. Cognito identity pools, which swap tokens for AWS credentials, have no direct Azure counterpart.
How does pricing compare between Amazon Cognito and Microsoft Entra External ID?
AWS: Per monthly active user, by feature plan (Lite, Essentials, Plus), with a free tier, plus SMS and advanced security charges. Azure: Per monthly active user, with a free tier, plus add-ons (such as SMS MFA). Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Developer – Associate (DVA-C02) [retiring]; AWS Certified Security – Specialty (SCS-C03); AWS Certified Solutions Architect – Associate (SAA-C03); Microsoft Certified – Identity and Access Administrator Associate (SC-300); Microsoft Certified – Azure AI Cloud Developer Associate (AI-200).