Is SMS MFA Status in Cognito user pools set by calling setPreferredMFA or is that something else?

This is nothing more but an inconsistency in AWS console/API responses. Example: Let's enable SMS MFA for a user:

aws cognito-idp set-user-mfa-preference --sms-mfa-settings Enabled=true,PreferredMfa=true --access-token <value>

Yes, in console it still looks as if SMS MFA was not enabled. But this is not true. Let's get our user's data:

aws cognito-idp get-user --access-token <value>

{
    "Username": "your-email@example.com",
    "UserAttributes": [
        {
            "Name": "sub",
            "Value": "491a3eba-381f-4c87-a7d6-befa21e49e82"
        },
        {
            "Name": "email_verified",
            "Value": "true"
        },
        {
            "Name": "phone_number_verified",
            "Value": "true"
        },
        {
            "Name": "phone_number",
            "Value": "+1234567890"
        },
        {
            "Name": "email",
            "Value": "your-email@example.com"
        }
    ],
    "PreferredMfaSetting": "SMS_MFA",
    "UserMFASettingList": [
        "SMS_MFA"
    ]
}

What you want to look at is the PreferredMfaSetting attribute. It tells you what your user choose for himself/herself.

And if you now try to authenticate like this:

aws cognito-idp initiate-auth --auth-flow USER_PASSWORD_AUTH --client-id <value> --auth-parameters USERNAME=<value>,PASSWORD=<value>

You will receive a response like this:

{
    "ChallengeName": "SMS_MFA",
    "Session": "<session-value>",
    "ChallengeParameters": {
        "CODE_DELIVERY_DELIVERY_MEDIUM": "SMS",
        "CODE_DELIVERY_DESTINATION": "+*********7890",
        "USER_ID_FOR_SRP": "your-email@example.com"
    }
}

Ok, so what is this thing in console doing? It is actually deprecated. Take a look at the documentation of the MFAOptions here: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.html

So let's just enable SMS MFA through the console and then check the output of GetUser:

{
    "Username": "your-email@example.com",
    "UserAttributes": [
        {
            "Name": "sub",
            "Value": "491a3eba-381f-4c87-a7d6-befa21e49e82"
        },
        {
            "Name": "email_verified",
            "Value": "true"
        },
        {
            "Name": "phone_number_verified",
            "Value": "true"
        },
        {
            "Name": "phone_number",
            "Value": "+1234567890"
        },
        {
            "Name": "email",
            "Value": "your-email@example.com"
        }
    ],
    "MFAOptions": [
        {
            "DeliveryMedium": "SMS",
            "AttributeName": "phone_number"
        }
    ],
    "PreferredMfaSetting": "SMS_MFA",
    "UserMFASettingList": [
        "SMS_MFA"
    ]
}

That's pretty much it.