Bypass codes are easy to configure on a per need basis, with options for time expiration, number of uses, etc.

In case of connectivity issues, one of the default authentication options is Duo Passcode, which is a rotating authenticator code you get off the Duo App on your device (which works regardless of network connectivity, much like any other authenticator app/token).

If you use it to secure endpoints, there's a failopen option that lets you through if Duo cannot be reached instead of blocking out your access. There's also an option to enable it for Remote access but not while logging in directly on the endpoint.

Overall, I've been fairly happy with Duo. We've been a client for 8+ years now. Today's issue prevented me from signing into the Administrator portal entirely (as if my account didn't exist) which would entirely block your ability to manage any of your users or applications. This has never happened to me before, and was entirely on their end, but I do not see any way around it other than waiting for Duo to address.