This is very interesting use case :).
As you are already on Yokohama, servicenow has enforced MFA for the non-sso logging users by default. Being said that, you can go through the the MFA Enforcement directive related details. You can go through the KB articles mentioned below and it will give you the insights of how and why are we inforcing it.
Since you have upgraded to yokohama, and you have got the new policy OOB in MFA Context - that is "Enforce MFA for non-SSO logins", this policy is actually tracking the users which are logging using username & password. This can be checked in the sys_user_mfa_enforcement_info table.
Reasoning behind this is, the end users will get some buffer time to familiarize themselves with the MFA, instead of suddently being enforced with MFA after the upgrade. I am putting the KBs added for the MFA enforcement here -
Concise KB about MFA Enforcement - KB1700938
Detailed FAQ KB About MFA Enforcement - KB1709783
Now coming to your use case, I see you have already enabled the Enable Multifactor Authentication flag for the users even then also they aren't getting the MFA enforced, because they are still in the self-enrolmentperiod (buffer-time to self-enrol themselves) as explained above.
From your question, I get that you want to enforce MFA for the users having @abc.com like email while doing local login. IFF that's what you are looking for precisely, then you can directly go to 2nd point. Otherwise you can go through all the below points and see which one suits your requirement -
1: If you want the Non-SSO users to do the local login with MFA enforced immediately, then as mentioned in the previous answers, you need to set the OOB available self-enrolment property value to 0.
glide.authenticate.multifactor.self_enrolment_period = 0.
This will enforce the MFA for all the users if they are doing local login irrespective of their email domain.
Note - This will enforce the MFA immediately for all the users doing local login after upgrade including the once with @abc.com domain.
2: Another way (require some customisations) to achieve this is -
2.1) Update status column of the existing entries for the users which satisfy your above criteria (domain = @abc.com) in the above table (sys_user_mfa_enforcement_info) to Enforced through gliderecord bulk update.
2.2) Add a custom BR on the above table, and run the above script on insert/update operation so that as soon as a user entry is created in this table with status = tracking, this BR updates it with status = Enforced if they satisfy your email domain criteria.
3: If you want to enable the MFA for these users even when they are doing the SSO login, that's also available. You have to enable another property to enforce that - glide.authenticate.mfa.with.multisso.enabled.
Please let me know if you have any followup questions on this. Would be happy to assist further.
Thanks!!
