MFA recovery
If you cannot complete MFA (lost device, new phone), contact your tenant administrator or platform support. They can reset MFA enrollment in Amazon Cognito or your SAML identity provider.
For Cognito-managed users, an admin may use the Cognito console → Users → select user → MFA → Reset, or equivalent automation.