Same with Cognito, to be honest. The vendor lock-in is so strong, the abstractions leak through every crevice, not even full AWS shops can tolerate it.

I truly believe this is why email-based logins have become quite popular. You delegate the security of the authentication to the client (whether they’re a B2B client or B2C doesn’t make much of a difference), you don’t need to have 2FA, password reset flows, etc.