Accounts and SSO: Part 5 — AWS Cognito and Microsoft Entra ID

AWS Cognito and Microsoft Entra ID are the identity services of the two largest cloud platforms. Both handle user sign-in and token issuance, but are aimed at different scenarios: Cognito is for users of your applications in AWS, Entra ID is for company employees and their access to Microsoft 365 and corporate systems.

AWS Cognito

Cognito consists of two parts:

• User Pools — a store of accounts with sign-up, sign-in, MFA and issuance of OpenID Connect tokens; external providers via SAML and OIDC and social networks can be connected here;
• Identity Pools — issuance of temporary AWS credentials to users for direct access to services like S3 or DynamoDB.

For user pools there are three pricing tiers (prices as of September 2026 according to AWS):

Users signing in via an external provider (SAML or OIDC) are billed separately: $0.015 per MAU beyond 50 free. SMS and confirmation emails are charged at SNS and SES rates.

Strengths: deep integration with Lambda, API Gateway and other AWS services, scaling without administrator intervention, hosted sign-in page editor.

Limitations: Cognito is mainly convenient within AWS; configuration of flows and triggers is not the most visual; migrating away requires exporting users, and passwords are not exported.

Microsoft Entra ID

Entra ID is the new name for Azure Active Directory. The rename was announced on July 11, 2023, and the tier names changed on October 1, 2023; features, prices and all sign-in addresses remained the same.

• Entra ID Free — included in Azure, Microsoft 365, Dynamics 365 and Intune subscriptions: single sign-on to SaaS applications and MFA.
• Entra ID P1 — $7 per user per month with an annual subscription, included in Microsoft 365 E3 and Business Premium; adds conditional access and hybrid integration with on-premises Active Directory.
• Entra ID P2 — $10 per user per month, included in Microsoft 365 E5; adds risk-based account protection and privileged access management.

For consumer-facing applications Microsoft offers Entra External ID with pay-per-active-user billing and a free allowance. The previous product for this task, Azure AD B2C, has not been sold to new customers since May 1, 2025, existing customers continue to use it.

Strengths: single sign-on across everything related to Microsoft 365, conditional access, integration with on-premises Active Directory via Entra Connect, large catalog of ready-made SaaS integrations.

Limitations: Entra ID is oriented toward organization employees, licensing is complex, and without the Microsoft ecosystem most of its advantages are lost.

Comparison

Can they be used in Russia

For Russian companies both services are practically unavailable.

• Microsoft suspended new sales in Russia on March 4, 2022.
• AWS payments are made by card, and Visa and Mastercard issued in Russia do not work abroad.
• Personal data. From July 1, 2025 the primary collection of personal data of Russian citizens is allowed only in databases located on the territory of the country, and registering users in a foreign cloud does not comply with this.

If you work with Russian users, an alternative is a self-hosted authentication server, for example Keycloak, and for accounts on Linux servers — FreeIPA.

Typical mistakes

• Choosing Cognito for a project outside AWS solely because of the free tier.
• Treating Entra ID as a service for customer registration: for that there is External ID, and Azure AD B2C is no longer sold to new customers.
• Not planning for exporting users: passwords are not exported from Cognito, migration requires password resets or gradual migration on sign-in.

When to choose

Cognito — if the application already runs in AWS and you need registration and sign-in for its users. Entra ID — if the company lives in Microsoft 365 and you need to manage employee access. For a Russian project both services are unavailable, and you have to choose among solutions hosted on your own servers.