Hi @dotorg Actually this is not possible. If an admin has superuser permission then it is possible to change anything. If you really want to achieve that all configuration is done in panorama you need to block the admins on the firewall/context switch - or allow only a very limited number of admins to do so and they need to be trained to only use panorama for the configuration. If this is not sufficient, you could contact your system engineer from paloalto to create a feature request for this.
... View more