# Cognito Users No Longer Need a New Account After Losing Their TOTP Device!

Hi, it's me, Shiichan! Today I found a small but genuinely useful update to Amazon Cognito, so let me walk you through it.

## What was announced?

According to AWS What's New, Amazon Cognito now offers a new admin API operation to reset a user's TOTP (time-based one-time password) MFA configuration. When a user loses access to their TOTP device — like their authenticator app phone — an administrator can remove that device's association. The user can then enroll a new device the next time they sign in.

## The story so far

Until now, there wasn't a clean way for administrators to just unhook a lost TOTP device and let the user re-enroll. If a user got locked out of MFA because they lost their device, admins had to fall back on recreating the account entirely to recover access — a heavier operation than it needed to be, especially when the goal was simply to restore a single user's sign-in path while keeping MFA in place.

## What changes

With the new API, admins can now surgically remove just the TOTP association for a locked-out user, instead of recreating the account. That should cut down on support overhead. Just as importantly, MFA enforcement stays intact throughout — there's no need to temporarily relax security just to get a user back in.

## Dive Deep

The new operation is called `AdminDeleteSoftwareToken`, and it's accessible via the AWS CLI, SDKs, or APIs.

```
AdminDeleteSoftwareToken
```

This capability is available in all AWS Regions where Amazon Cognito is available. For setup details, check the API reference and the developer guide section on user pool MFA / TOTP configuration.

## Wrap-up

- Amazon Cognito added a new admin API, `AdminDeleteSoftwareToken`, to reset a user's TOTP MFA configuration.
- Users who lose their TOTP device can now recover by re-enrolling a new one, without needing their account recreated.
- MFA enforcement stays intact throughout the recovery process.
- It's callable via AWS CLI, SDKs, or APIs, and available in every AWS Region where Cognito runs.
- A small but welcome win for anyone running MFA and handling account-recovery support for Cognito user pools.