RHEL8 - Why are local users logging on always being validated to sssd?

In RHEL8, I am validating users logging on both locally and via sss to LDAP. The problem is though no matter what I do, local users are always going out to LDAP. I would think it would succeed for files, and then return.

In my nsswitch.conf, I am specifyng files first, then sss for both passwd and group.

Is there another config file or parameter that I am not seeing?

Any thoughts appreciated.

Thanks