unless it has the "mandatory" box marked, then it's not 2FA required. Sounds like Celigo installed a role specifically to avoid 2FA