I was struggling with the same problem - I found out, that I had to switch MFA explicitly in services using:
{
"@class" : "org.apereo.cas.services.RegexRegisteredService",
"name" : "localhost",
"theme" : "apereo",
"id" : 10000003,
"description" : "Apereo foundation sample service",
"evaluationOrder" : 1
"multifactorPolicy" : {
"@class" : "org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy",
"multifactorAuthenticationProviders" : [ "java.util.LinkedHashSet", [ "mfa-radius" ] ]
}
}