How do I enable the Salesforce login sandbox?

Using MFA in combination with SSO requires a separate setting, as described in the salesforce docs To set up the Salesforce login sandbox MFA service, take these steps. In Setup, in the Quick Find box, enter Session, then select Session Settings.

In Session Security Levels, make sure your SSO configuration is in the Standard column. And make sure Multi-Factor Authentication is in the High Assurance column.

From Setup, in the Quick Find box, enter Profiles, then select Profiles. Click the profile name, then click Session Settings in the System section. Click Edit, set Session Security Level Required at Login to High Assurance, then save your changes.