First, the Search username format is wrong. Per the DAG AD authentication instructions you should specify the username in NTLM DOMAIN\username format. I am guessing yours should be TEST-AD\duomfa.
Second, your search base valueis wrong. CN=Users,CN=Builtin,DC=TEST_AD,DC=internal,CN=Administrators is not a valid DN for those containers in AD.
If you want to specify more than one search base they should be one per line, and they need to be complete DNs. So, this would be valid to search all those containers:
CN=Users,DC=TEST_AD,DC=internal
CN=Builtin,DC=TEST_AD,DC=internal
CN=Administrators,DC=TEST_AD,DC=internal
