# Cognito SaaS tenancy + managed login checklist (July 2026)

Docs: [managed login](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managed-login.html). Feature plans matter — **Lite** may only expose classic hosted UI.

## Tenancy model

| Pattern                   | When                                        | Hard limit to remember                          |
| ------------------------- | ------------------------------------------- | ----------------------------------------------- |
| Pool + `custom:tenant_id` | Most B2B SaaS                               | Authorizer must enforce tenant on every request |
| Silo (pool per tenant)    | Regulated isolation / per-tenant IdP policy | ~1,000 user pools / Region (verify quotas)      |

- [ ] Tenant routing chosen (subdomain / email domain / picker) with a durable mapping store
- [ ] App client callback/logout URLs per environment — no hardcoded pool IDs in source
- [ ] Groups/claims for coarse roles only; fine-grained authZ outside Cognito

## Login UX

- [ ] Prefer **managed login** + branding editor for net-new (passkeys where plan supports)
- [ ] Classic hosted UI only if you need Lambda custom-auth challenge flows managed login excludes
- [ ] Custom UI via Amplify / SDK when pixel control is mandatory

## Federation

- [ ] SAML/OIDC IdP count within pool quotas (verify current limit)
- [ ] Attribute mapping documented per enterprise customer
- [ ] Token validation server-side (API Gateway Cognito authorizer or verified JWT lib)

## Exit risk

- [ ] Cognito is not the only store of profile data (password hashes are not exportable)
- [ ] User migration Lambda path tested if replacing a legacy IdP