@sebastianschmid - Yes, after upgrade to Y, MFA would be enforced, but there is a provision of self -enrolment of 30 days, during which users will see the info msgs about the MFA Enforcement. The end users who aren't already enforced with MFA during local login, can self -enrol themselves during this period and once this period is over, it will enforce them the MFA during the local login. This period can be changed as per the business requirements. That is the reason you weren't getting the MFA immediately.
Please go through the below KBs for more details -
