So I'm running two PaloAlto's in HA.. And we've been using Local authentication for years at this point for administration. We just setup MFA using Fortiauthenticator (Ugh I know, but it works as a regular Radius)

So now I'm looking into securing the management with MFA.

From my understanding I just go to Device->Management-> Authentication Settings -> Authentication Profile -> (select the profile where it's limited to just a few users)

Then presumably management would be done via MFA? But in case things don't work right.. Would the local authentications still work? I have yet to find a clear documentation on this.. Other then you can't select a authentication sequence it has to be a specific profile.