The local admin acct needs to be excluded from the 2FA requirement for operational reasons. We utilize that acct as a breakglass acct so it's not really feasible to have a single engineer with the key.