It is not clear on the documentation that enable MFA on the master account is mandatory to be able to administer and change passwords for local users.