If an Amazon Cognito user pool shows MFA disabled and advanced security disabled, two separate protections are off: Cognito is not requiring pool-level multi-factor authentication for local-user sign-ins, and the pool is not applying threat protection’s risk monitoring and adaptive responses. That does not, by itself, tell you whether passwords, app clients, AWS WAF, or federated identity providers are secure. Check those separately.
What the two disabled settings mean
MFA and threat protection are independent user-pool controls. Enabling one does not automatically enable the other. AWS now calls the capabilities previously known as advanced security features threat protection.
As an Amazon Associate I earn from qualifying purchases.
- MFA off: Cognito does not impose its pool-level MFA requirement on local users. This is not the same as proving that no other sign-in control exists.
- Threat protection off: Cognito does not apply that pool’s risk monitoring and associated adaptive responses.
Neither status establishes the quality of password rules, app-client configuration, WAF protections, or security controls at an external identity provider. See AWS’s user-pool security best practices for the broader security picture.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Who is covered: local users and federated users
Cognito’s MFA and threat-protection features apply to local users. For users who sign in through a third-party identity provider, that provider controls the relevant authentication security. A pool setting that is off should therefore prompt separate checks of local accounts and each federated provider’s policies. AWS explains this distinction in Using Amazon Cognito user pools security features.
#1 Best Overall
- Your favorite music and content – Play music, audiobooks, and podcasts from Amazon Music, Apple Music, Spotify and others or via Bluetooth throughout your home.
- Alexa is happy to help – Ask Alexa for weather updates and to set hands-free timers, get answers to your questions and even hear jokes. Need a few extra minutes in the morning? Just tap your Echo Dot to snooze your alarm.
- Keep your home comfortable – Control compatible smart home devices with your voice and routines triggered by built-in motion or indoor temperature sensors. Create routines to automatically turn on lights when you walk into a room, or start a fan if the inside temperature goes above your comfort zone.
- Do more with device pairing – Fill your home with music using compatible Echo devices in different rooms, or create a home theatre system with Fire TV.
- Say goodbye to drop-offs and buffering - With eero Built-in, Echo Dot doubles as a mesh wifi extender, adding up to 1,000 sq. ft. of wifi coverage to your existing eero network.
Choose an MFA policy that matches the requirement
Cognito has three MFA modes. The right choice depends on whether every local user must use MFA or whether MFA should be triggered selectively.
| MFA mode | Effect | Important consideration |
|---|---|---|
OFF |
No pool-level MFA requirement for local-user sign-in. | Does not configure risk-based MFA by itself. |
ON |
Users must set up MFA before they can sign in. | Plan enrollment, factor availability, and account recovery. |
OPTIONAL |
The application can determine whether users enroll. | Managed login does not automatically prompt users to set up MFA in this mode. |
For a blanket MFA requirement, consider ON and prepare the user-enrollment and recovery experience before enforcing it. AWS documents the settings in the SetUserPoolMfaConfig API reference.
Rank #2
- Your favorite music and content – Play music, audiobooks, and podcasts from Amazon Music, Apple Music, Spotify and others or via Bluetooth throughout your home.
- Alexa is happy to help – Ask Alexa for weather updates and to set hands-free timers, get answers to your questions and even hear jokes. Need a few extra minutes in the morning? Just tap your Echo Dot to snooze your alarm.
- Keep your home comfortable – Control compatible smart home devices with your voice and routines triggered by built-in motion or indoor temperature sensors. Create routines to automatically turn on lights when you walk into a room, or start a fan if the inside temperature goes above your comfort zone.
- Do more with device pairing – Fill your home with music using compatible Echo devices in different rooms, or create a home theatre system with Fire TV.
- Say goodbye to drop-offs and buffering - With eero Built-in, Echo Dot doubles as a mesh wifi extender, adding up to 1,000 sq. ft. of wifi coverage to your existing eero network.
Does adaptive authentication work when MFA is disabled?
Adaptive authentication is a risk-based approach, not simply another name for turning the blanket MFA setting on. AWS advises setting MFA to OPTIONAL for a pool using adaptive authentication with threat protection. Adaptive authentication can then challenge sign-ins according to risk; if a user has an MFA method activated, that user receives an MFA challenge on sign-in. AWS states the configuration pattern in SetUserPoolMfaConfig and describes adaptive authentication in its adaptive authentication guide.
Free tools Windows power users keep installed
One-click scans. No signup required.
So, a pool showing MFA OFF should not be treated as a configured adaptive-MFA policy. For risk-based challenges, configure the documented OPTIONAL-MFA pattern and threat protection, then verify the relevant user MFA preferences and authentication flows.
Rank #3
- Meet Echo Dot Max: Experience rich room-filling sound that automatically adapts to your space and fine-tunes playback. Features a built-in smart home hub and Omnisense technology for highly personalized experiences.
- Music to your ears: With nearly 3x the bass versus Echo Dot (2022 release), it fits beautifully in any space, delivering your personal sound stage with deep bass and enhanced clarity. Listen to streaming services, such as Amazon Music, Apple Music, Spotify, and SiriusXM. Encore!
- Do more with device pairing: Connect compatible Echo smart speakers and smart displays in different rooms, or pair with a second Echo Dot Max to enjoy even richer sound
- Simple smart home control: Set routines, pair and control lights, locks, and thousands of smart home devices that work with Alexa without needing a separate smart home hub. With Omnisense technology, you can activate routines via temperature or presence detection.
- Say goodbye to drop-offs and buffering - With eero Built-in, Echo Dot Max doubles as a mesh wifi extender, adding up to 1,000 sq. ft. of wifi coverage to your existing eero network.
Threat protection: monitor first or enforce responses
Threat protection has distinct operating modes. In audit-only mode, Cognito records risk information and metrics without applying mitigations. In full-function mode, configured responses can act on detected risks, including requiring MFA, blocking sign-in, logging activity, or notifying the user. The available response depends on the risk configuration and authentication context; this is not an automatic guarantee that every risky sign-in will be blocked.
AWS recommends observing in audit-only mode for at least two weeks before moving to full-function mode. Use that period to review detections and assess false positives and missed risks. If automatic MFA requirements are part of the response, ensure the application can collect phone numbers for SMS MFA or support authenticator-app registration for TOTP. The operational guidance and configuration details are in AWS’s advanced security with threat protection guide.
Rank #4
- Your favorite music and content – Play music, audiobooks, and podcasts from Amazon Music, Apple Music, Spotify and others or via Bluetooth throughout your home.
- Alexa is happy to help – Ask Alexa for weather updates and to set hands-free timers, get answers to your questions and even hear jokes. Need a few extra minutes in the morning? Just tap your Echo Dot to snooze your alarm.
- Keep your home comfortable – Control compatible smart home devices with your voice and routines triggered by built-in motion or indoor temperature sensors. Create routines to automatically turn on lights when you walk into a room, or start a fan if the inside temperature goes above your comfort zone.
- Do more with device pairing – Fill your home with music using compatible Echo devices in different rooms, or create a home theatre system with Fire TV.
- Say goodbye to drop-offs and buffering - With eero Built-in, Echo Dot doubles as a mesh wifi extender, adding up to 1,000 sq. ft. of wifi coverage to your existing eero network.
Check plan, app-client overrides, and sign-in flows
Before changing settings, check the user pool’s feature plan and effective configuration. AWS’s current feature-plan documentation says threat-protection modes AUDIT and ENFORCED require the Plus tier; confirm current plan and pricing details before implementation in the user pool feature plans guide.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Inspect pool and client settings: app-client threat-protection settings can override pool-level configuration.
- Identify authentication flows: threat protection can be configured for standard and custom authentication. Confirm which flows the application actually uses.
- Check local and federated populations separately: Cognito controls do not replace the federated provider’s own protections.
- Review risk responses: decide whether each relevant risk should be logged, trigger MFA, block sign-in, or notify the user. AWS exposes risk configuration through the SetRiskConfiguration API.
The controls and mode behavior are described in AWS’s threat protection guide and UserPoolAddOnsType API reference.
Best Value
- MEET ECHO SPOT - A sleek smart alarm clock with Alexa and big vibrant sound. Ready to help you wake up, wind down, and so much more.
- CUSTOMIZABLE SMART CLOCK - See time, weather, and song titles at a glance, control smart home devices, and more. Personalize your display with your favorite clock face and fun colors.
- BIG VIBRANT SOUND - Enjoy rich sound with clear vocals and deep bass. Just ask Alexa to play music, podcasts, and audiobooks. See song titles and touch to control your music.
- EASE INTO THE DAY - Set up an Alexa routine that gently wakes you with music and gradual light. Glance at the time, check reminders, or ask Alexa for weather updates.
- KEEP YOUR HOME COMFORTABLE - Control compatible smart home devices. Just ask Alexa to turn on lights or touch the screen to dim. Create routines that use motion detection to turn down the thermostat as you head out or open the blinds when you walk into a room.
A practical remediation sequence
- Decide the policy: choose blanket MFA for every local user, or risk-based step-up MFA. Do not assume the two disabled indicators express the same policy.
- Prepare enrollment and recovery: make sure users can register an available factor and regain account access if they lose it.
- Configure MFA: use
ONfor a universal pool requirement. For adaptive authentication, use the AWS-recommendedOPTIONALconfiguration and ensure users have an activated MFA method where challenges are expected. - Configure threat protection: verify the feature plan, set the intended audit or enforcement mode, and define responses for relevant risks.
- Observe before enforcing: if starting in audit-only mode, review the resulting risk data for at least two weeks before enabling full-function responses.
- Validate effective scope: check pool defaults, app-client overrides, standard or custom flows, local-user behavior, and external provider policies.
- Review posture findings: Security Hub has separate checks for MFA and threat protection. Treat a finding as an indicator of that configuration state, then verify pool and client settings directly; neither check establishes the overall security of the pool.
AWS describes threat-protection modes and responses in its developer guide and provides the relevant Security Hub checks in Security Hub CSPM controls for Amazon Cognito.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
