Check your policies. Do you have an effective new user policy, authentication policy, or authorized networks policy in place that would allow that user, IP address, or application to bypass 2FA? If testuser exists in your Duo account, does that user have bypass status?
