If the Bypass Duo authentication when offline box is selected during installation, authentication attempts "fail open" after primary authentication is successful if the Duo service cannot be contacted. If you leave that option unchecked during install, Duo for Rd Web or RD Gateway logins "fail closed", blocking RDS access if there is a problem contacting the Duo service.