UserMFASettingList: the MFA factors the user enabled. Not
ConfiguredUserAuthFactors, which lists EMAIL_OTP for every login while
the pool sends email in DEVELOPER mode.
WEB_AUTHN is in ConfiguredUserAuthFactors: the user holds a passkey.
PreferredMfaSetting.
UserStatus: CONFIRMED, FORCE_CHANGE_PASSWORD, UNCONFIRMED, EXTERNAL_PROVIDER…
What
AdminGetUserandAdminGetUserAuthFactorssay about a user's sign-in, as Cognito names it.