Auth0 vs Amazon Cognito (2026): CIAM Compared After Cognito Adds Step-Up and ACR/AMR Claims

AWS Cognito vs Auth0 is mostly a question of how much you want built in. Amazon Cognito is usually the cheaper and simpler choice if your workloads already run on AWS, and Auth0 is usually the deeper customer identity platform when you need extensibility, B2B tenancy and enterprise connections. Both are identity management as a service (IDaaS) products, meaning a vendor runs the login, user store and token issuing for you and bills by monthly active users (MAU). The comparison changed on 2 October 2026, when the AWS SDK changelog recorded that Cognito User Pools now issue the OIDC-standard authentication context class reference (ACR) and authentication methods reference (AMR) claims on access and ID tokens, and now support step-up authentication through the existing authentication APIs (botocore CHANGELOG, cognito-idp, release 1.43.108, October 2026).

This post compares the two as of 18 October 2026, using each vendor’s own documentation. It describes how each product bills rather than quoting rates, because the rates change and the shape of the meter is what decides how your cost behaves as you grow.

Key Takeaways

• Since 2 October 2026 Cognito issues ACR and AMR claims on its tokens, and requesting step-up (or renaming the ACR levels) requires the Essentials or Plus feature plan (AWS, Amazon Cognito Developer Guide, 2026).
• Auth0 still offers more built-in B2B structure, with Organizations and an Actions extension model; Cognito gives you AWS integration and tiered feature plans.
• Both bill per MAU, so a customer with thousands of employees signing in raises either bill regardless of what that customer pays you.

What changed in 2026 for Cognito and Auth0?

Cognito shipped several security and resilience features in 2026, and Auth0 made its extensibility and B2B tooling more reusable. These are the dated changes that matter for a comparison.

For Cognito, the AWS API changes feed, which mirrors the service’s API model changes, includes these entries in 2026 (awsapichanges.info, Amazon Cognito Identity Provider, retrieved 2026-10-18):

• 27 February: a two-secret rotation model for app clients, so you can rotate a client secret without downtime.
• 16 April: passkey-based multi-factor authentication, using FIDO2 passkeys with user verification.
• 1 June: multi-Region replication of user data and configuration to a secondary user pool in a standby Region, together with support for customer managed AWS KMS keys for encrypting user pool data at rest.
• 2 October: ACR and AMR claims on access and ID tokens, plus step-up authentication through the existing authentication APIs, which the AWS SDK changelog also records.

For Auth0, the product changelog lists several relevant entries (Auth0, Changelog, 2026 entries). On 9 April it released the My Organization API and embeddable components in early access, which the changelog says include automatic step-up authentication that triggers inline MFA for privileged actions. On 12 May it released “Secure your Account API with ACR” in early access, which enforces step-up for sensitive scopes on the My Account API through Actions-driven policies or a secure-by-default toggle. On 16 September it announced B2B Connect for enterprise in early access, which layers Auth0 enterprise SSO, SCIM provisioning and multi-tenant organization management on top of an authorization server you already run. On 18 September Actions Modules reached general availability, which lets you write shared code once and import it into several Actions. The B2B Connect feature is the product that some earlier coverage called Enterprise Connect, and we cover it in Auth0 B2B Connect vs Keycloak Organizations.

Does Amazon Cognito support step-up authentication now?

Yes, on the Essentials or Plus feature plan. Step-up authentication means asking a user for a stronger proof, such as a second factor, only when they attempt something sensitive instead of at every login. The Amazon Cognito Developer Guide page on authentication levels with ACR and AMR claims says that requesting step-up requires the Essentials or Plus feature plan (AWS, Authentication levels with ACR and AMR claims, Amazon Cognito Developer Guide, retrieved 2026-10-18). On the Lite plan, the InitiateAuth API returns a FeatureUnavailableInTierException, and the managed login authorize endpoint silently ignores acr_values and signs the user in normally, so a test on the wrong plan can look as if it worked.

ACR states the level of assurance of a login and AMR lists the methods used. You request a level with the acr_values parameter on the managed login authorize and login endpoints, or with TARGET_ACR_VALUES in the USER_AUTH API flow, and you can add max_age (MAX_AGE in the API) to require a recent authentication. Cognito defines four fixed levels, urn:cognito:loa:1 for password only through urn:cognito:loa:4 for a password with an authenticator-app code, and on Essentials or Plus you can rename the level URIs with the AcrConfiguration field but not change which factors satisfy each one. For federated users, Cognito derives the values from the identity provider’s response and maps them with the AcrMapping field. Enforcement stays with your application: Cognito issues the token with the level reached, and your API must check the acr claim and auth_time before it allows a sensitive action.

Auth0 has supported step-up for longer, and its documented model works differently. It uses scopes, access tokens and an Action that triggers an MFA prompt when a sensitive scope is requested, and for web apps it describes checking whether the ID token’s amr claim contains mfa (Auth0, Add Step-up Authentication, Auth0 Docs; Auth0, Configure Step-up Authentication for Web Apps, Auth0 Docs). A practical difference is token refresh. Auth0 documents that amr is not present on tokens from silent authentication or refresh tokens, because the user completed MFA earlier, while Cognito says it carries the same acr and amr values onto refreshed access and ID tokens and does not reset auth_time. Whichever product you choose, design your API to treat a missing or stale claim as “not stepped up”. Our Keycloak step-up authentication guide explains the pattern itself in detail.

Auth0 vs Cognito: how do they compare feature by feature?

Both cover the basics of customer identity: hosted sign-in, social login, multi-factor authentication, passwordless options and federation with SAML and OIDC identity providers. The differences are in how much structure each gives you for B2B products and how you extend the login flow.

The Cognito plan details come from the AWS pricing page and the feature plans page (AWS, Amazon Cognito Pricing, retrieved 2026-10-18; AWS, User pool feature plans, Amazon Cognito Developer Guide). AWS describes Lite as the basic plan, Essentials as adding Managed Login and passwordless options such as passkeys, email and SMS, and Plus as adding risk-based adaptive authentication, compromised credential detection and exporting authentication event logs. The multi-tenancy row reflects the Developer Guide page “Multi-tenant application best practices”, which describes separating users into per-tenant user pools or using app clients, groups and custom attributes within a shared pool (AWS, Multi-tenant application best practices, Amazon Cognito Developer Guide). The Auth0 Organizations row comes from Auth0’s own description of the feature (Auth0, Organizations, Auth0 Docs).

Inbound SCIM provisioning lets a customer’s directory create and remove accounts automatically, and Auth0 treats it as a plan feature that depends on the track. The Auth0 pricing page, retrieved 18 October 2026, shows inbound SCIM as included on the Free and Enterprise plans and not included on the B2C Essentials and Professional plans, with a footnote saying to upgrade to B2B to keep using enterprise connections, self-service SSO and SCIM (Auth0, Pricing, retrieved 2026-10-18). We did not find SCIM listed on the Cognito pricing page, feature plans page or FAQ, so if you need it, confirm the current position with AWS before you commit.

How do the pricing models differ?

Both products bill by monthly active users, and both add cost as you move up to more advanced features. A monthly active user is someone who signs in or generates an identity operation during a calendar month, so total registered accounts matter less than activity. The more useful question is what each meter counts for a B2B customer.

Cognito’s free allowance of 10,000 MAU for users who sign in directly or through a social identity provider applies per AWS account or AWS organization, and only to the Lite and Essentials plans; Plus has no such allowance. Users federated through SAML or OIDC have a separate allowance of 50 MAU on any plan and are billed as their own line (AWS, Amazon Cognito Pricing, retrieved 2026-10-18). That matters for the feature comparison above, because step-up needs Essentials or Plus and adaptive authentication needs Plus. AWS’s own worked example for 5,000 SAML or OIDC MAU shows those users billed above the 50-user allowance, which means a single large enterprise customer shows up quickly on the invoice. Our post on whether Cognito is still the right fit as you scale walks through that arithmetic.

Auth0’s pricing page, retrieved 18 October 2026, lists a free plan with up to 25,000 MAU that includes five Organizations and one enterprise connection, and paid plans that differ in how many Organizations and enterprise connections they include (Auth0, Pricing, retrieved 2026-10-18). Consider what onboarding one customer with 5,000 employees does on the Auth0 side: it adds up to 5,000 active users against your MAU band, usually one more Organization to represent the customer, and one more enterprise connection for their identity provider, and the pricing page makes the latter two plan-limited. The meter that grows fastest for a B2B product is therefore often the count of Organizations and enterprise connections on top of MAU, not users alone. Plan limits change often, so read the live page when you budget.

A third model is infrastructure-based pricing, where a managed Keycloak service charges for the cluster or plan instead of per user or per connection. Keycloak is an open source identity provider with SAML and OIDC brokering, Organizations and ACR-based step-up built in. A managed service shifts the cost curve from user count to cluster size, in exchange for you owning more of the configuration. Our Keycloak vs Cognito comparison and Keycloak vs Auth0 comparison cover that trade in more depth.

What does lock-in look like on each side?

The lock-in on Cognito is mostly coupling to AWS. Customization runs through Lambda triggers and the token and attribute model is Cognito’s own, and if you also use Cognito identity pools, those exchange tokens for AWS IAM roles, which ties your authorization to AWS as well. User pools on their own do not require IAM roles. None of that is a problem while you stay on AWS, but moving away means rewriting the trigger logic and remapping attributes. Our Cognito alternatives guide for developers lists those coupling points.

The lock-in on Auth0 is mostly in Actions and in how user data leaves the platform. Actions are JavaScript that runs inside Auth0, so that logic has to be rewritten elsewhere. For password hashes, Auth0 documents a support-case process in which you generate a PGP key and receive an encrypted export of password hashes and MFA secrets (Auth0, Export Password Hashes and MFA Secrets, Auth0 Docs). AWS documents importing users into Cognito, including with existing password hashes, but we found no documented way to export password hashes from a user pool (AWS, Importing users into user pools from a CSV file, Amazon Cognito Developer Guide). Users leaving Cognito therefore generally need a password reset or a gradual migration on first login, as we describe in our Cognito to Keycloak migration guide.

When should you pick neither?

Consider neither product when your growth is in enterprise customers or in very large member bases, because per-MAU billing ties identity cost to head count rather than to revenue. A B2B SaaS product that adds enterprise SSO for each customer, or an education or nonprofit service with a large member base and a small budget, tends to feel this first. In that case an infrastructure-priced, standards-based option such as managed Keycloak can be easier to forecast, and our Auth0 alternatives guide and Cognito alternatives guide compare the options. If AWS is your home and your needs are modest, Cognito is a reasonable start, and if you expect heavy B2B customization, Auth0’s Organizations and Actions model will save engineering time.

Frequently asked questions

Does Cognito support step-up authentication now?

Yes, on the Essentials or Plus feature plan. The AWS SDK changelog records ACR and AMR claims and step-up support from 2 October 2026, and the Developer Guide says Lite returns FeatureUnavailableInTierException from InitiateAuth (AWS, Amazon Cognito Developer Guide, 2026).

Which Cognito plan do I need for step-up?

You need the Essentials or Plus feature plan, because AWS says requesting step-up needs one of those plans, and only Plus adds risk-based adaptive authentication and compromised credential detection. Essentials and Lite have the 10,000 MAU free allowance for direct sign-ins, and Plus has none (AWS, Amazon Cognito Pricing, 2026).

Can Cognito do SAML per tenant?

Yes, in the sense that Cognito federates with SAML 2.0 and OIDC identity providers, and federated users are billed on their own line. Mapping each customer’s provider to user pools and app clients is design work that you do, since AWS’s multi-tenant guidance describes patterns rather than a built-in tenant object (AWS, Amazon Cognito Developer Guide, 2026).

Can I export Auth0 password hashes?

Yes, through a support request. Auth0 documents a PGP-encrypted export of password hashes and MFA secrets that you request from the tenant administrator account (Auth0, Export Password Hashes and MFA Secrets, Auth0 Docs, 2026). Plan for its key requirements: an RSA PGP key valid for at least 7 days, a request from the tenant administrator, and a download link that expires after 3 days.

Cognito vs Auth0: which is cheaper?

It depends on your users and your enterprise connections. Cognito bills by MAU with separate lines for federated users and higher plans for advanced security, and Auth0 bills by MAU with plan limits on Organizations and enterprise connections. Model your own forecast on each vendor’s live pricing page.

Are Auth0 and Cognito the same kind of product?

Both are customer identity and access management services that run login for your applications, but they sit differently. Cognito is an AWS service integrated with the rest of AWS, while Auth0 is a standalone platform with its own extensibility and B2B features.

Sources

• botocore, “CHANGELOG”, release 1.43.108 (cognito-idp api-change), retrieved 2026-10-18, https://github.com/boto/botocore/blob/develop/CHANGELOG.rst
• awsapichanges.info, “Amazon Cognito Identity Provider”, retrieved 2026-10-18, https://awsapichanges.info/archive/service/cognito-idp/
• AWS, “Authentication levels with ACR and AMR claims”, Amazon Cognito Developer Guide, retrieved 2026-10-18, https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html
• AWS, “Amazon Cognito Pricing”, retrieved 2026-10-18, https://aws.amazon.com/cognito/pricing/
• AWS, “User pool feature plans”, Amazon Cognito Developer Guide, retrieved 2026-10-18, https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html
• AWS, “Multi-tenant application best practices”, Amazon Cognito Developer Guide, retrieved 2026-10-18, https://docs.aws.amazon.com/cognito/latest/developerguide/multi-tenant-application-best-practices.html
• AWS, “Importing users into user pools from a CSV file”, Amazon Cognito Developer Guide, retrieved 2026-10-18, https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html
• Auth0, “Changelog”, 2026 entries, retrieved 2026-10-18, https://auth0.com/changelog
• Auth0, “Add Step-up Authentication”, Auth0 Docs, retrieved 2026-10-18, https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication
• Auth0, “Configure Step-up Authentication for Web Apps”, Auth0 Docs, retrieved 2026-10-18, https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication/configure-step-up-authentication-for-web-apps
• Auth0, “Organizations”, Auth0 Docs, retrieved 2026-10-18, https://auth0.com/docs/manage-users/organizations
• Auth0, “Pricing”, retrieved 2026-10-18, https://auth0.com/pricing
• Auth0, “Export Password Hashes and MFA Secrets”, Auth0 Docs, retrieved 2026-10-18, https://auth0.com/docs/manage-users/user-migration/export-password-hashes-and-mfa-secrets