Yes, you may use these authentication devices for both online and offline access with a single device: Is it possible to use the same authentication device for both online and offline Windows Logon?
HyperFIDO tokens are not supported for offline access activation, nor are simple OTP passcode tokens or Duo D-100 hardware tokens. Offline access for Windows Logon works with these security keys: Which security keys are compatible with offline access with MFA? Yes, MFA using a Duo Mobile passcode or supported U2F security key while a Windows system is unable to reach Duo's service is supported in version 4.0 and later. Does Duo Authentication for Windows Logon support offline multifactor authentication? We recommend updating any domain controllers with 4.1.0 installed to 4.1.1 before attempting to install the latest available version. Version 4.1.1, released July 13, 2020, corrects this issue and is suitable for installation on domain controllers, member servers, and workstations. There is a known issue with installation of the latest release of Duo Authentication for Windows Logon and RDP, version 4.1.0, on Active Directory domain controllers that may trigger user lockouts. General Are there any issues installing Duo for Windows Logon on Active Directory domain controllers? Duo integrates with Microsoft Windows client and server operating systems to add two-factor authentication to Remote Desktop and local logons.
