A solutions architect is designing user authentication. The solution must invoke two-factor authentication for users who log in from inconsistent geographic locations, IP addresses, or devices. It must also scale to millions of users. Which solution meets these requirements?

Amazon Cognito user pools are designed for scalable user authentication, supporting millions of users. Its risk-based adaptive authentication feature automatically detects unusual login behavior (like inconsistent geographic locations, IP addresses, or devices) and can be configured to prompt for multi-factor authentication (MFA) in such scenarios, directly addressing the requirement. Amazon Cognito identity pools are primarily for authorizing access to AWS resources, not for user authentication itself. While they can integrate with user pools, they don't provide the adaptive authentication feature. AWS IAM users are suitable for authenticating users to AWS accounts but do not scale to millions of external application users and lack adaptive authentication capabilities. AWS IAM Identity Center (AWS Single Sign-On) is for managing access to multiple AWS accounts and business applications, not typically for authenticating external users of a custom application, and it doesn't offer risk-based adaptive MFA.