TACACS authentication

We are trying to switch our users to tacacs from local (CLI configured as Local->TACACS+)

For some reason local users (configured as User) are correctly shown portaccessmenu but those authenticating with tacacs are dropped into configmenu. The manual suggests that remote authenticated users are treated as USER, not ADMIN.

Am I missing a config somewhere?

Device is CM16,
F/W Rev. : v1.9.5
B/L Ver. : v1.2.0

Thank you!