this is from Microsoft and technically correct IF you are not accessing any network resources:
"Only privileged users are required MFA for local access (if regular user accounts have administrative rights only on their computers, they are not considered a “privileged account” and as such do not require MFA authentication for local access). "
Per NIST 800-171r2:
"3.5.3: Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts
Multifactor authentication requires the use of two or more different factors to authenticate. The factors are defined as something you know (e.g., password, personal identification number [PIN]); something you have (e.g., cryptographic identification device, token); or something you are (e.g., biometric). Multifactor authentication solutions that feature physical authenticators include hardware authenticators providing time-based or challenge-response authenticators and smart cards. In addition to authenticating users at the system level (i.e., at logon), organizations may also employ authentication mechanisms at the application level, when necessary, to provide increased information security.
Access to organizational systems is defined as local access or network access. Local access is any access to organizational systems by users (or processes acting on behalf of users) where such access is obtained by direct connections without the use of networks. Network access is access to systems by users (or processes acting on behalf of users) where such access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. The use of encrypted virtual private networks for connections between organization-controlled and non-organization controlled endpoints may be treated as internal networks with regard to protecting the confidentiality of information."
So, in theory a local non privileged account lacking network access is exempt from the requirement. But that means all data has to be hosted local and not shared in any way. The idea was the industrial machines and appliances that cannot have multi factor enabled, are exempt from the requirement. Problem is machines cannot be on the network without multi factor, and removable media is controlled so the only way to load programs to machines is through a dedicated connection that is not traversable.
You end up with a workstation at each machine for loading programs. Each workstation requires multi factor to access the network shared data, then loaded to the machine directly.
This is fundamentally incorrect
again
Per NIST 800-171r2:
" 3.1.5: Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. "
No idea where this guy gets the idea that local admin accounts are not considered “privileged accounts” when he could have simply read more of the NIST documentation…