Hm… now that’s something I hadn’t considered. I note with a number of users their failed logins are indeed during the night, or early morning. In particular if they don’t log out of our VPN, then the VPN back-end server will log them out after some hours of inactivity. Once the connection is broken the VPN client on their user’s laptop will attempt to reconnect 10 times, at 1 minute intervals. At 10 failures, Duo will lock them out for 55 minutes or so, then unlock them.
I was thinking the users would be complaining about seeing multiple pushes to their phones, but if they have turned them off or placed them on “Do Not Disturb”, then of course they wouldn’t see the pushes. Thanks for the suggestion.