1. I understand your premise as:
"I have an account with username "xyz" for some application, and that application is protected with a 2FA Duo application. I have "xyz" as a valid user in Duo. I want to let an external person, Mary Lastname, log in as "xyz" without having her know the password. I will share the password for the "xyz" user with Mary via Lastpass, but not let her view the password. I also want to provide Mary with a Duo bypass code so she can complete Duo 2FA when she logs in as the "xyz" user."
Is that correct? I am not sure what "VA" means.
2. Is this a Lastpass question? I think you can share a credential from Lastpass with someone whose email is not part of your organization. You would not add that individual as a Duo user at all in the scenario I described above.
3. OK, this question makes me wonder if the scenario I described above is not actually what you want to do. We do not offer Duo 2FA services for TikTok or Pinterest (meaning, authentication backed by our cloud service). So now I think you are wondering about using Duo Mobile as an authenticator app that generates passcodes for third-party services. Is that actually what you want? Because in that scenario - you as an admin do not manage the accounts in Mary's Duo Mobile app at all, nor can you issue Duo bypass codes to anyone. We call this type of use case "third-party accounts" - https://guide.duo.com/third-party-accounts.
Example - Instagram. I have an Instagram account. I log into Instagram and go to my account settings. There is an option to turn on two-factor authentication. I do that and choose to use an authenticator app. I have decided to use Duo Mobile as my authenticator app. I scan the QR code for Instagram with Duo Mobile. That Instagram account shows up in my app. The next time I log in to Instagram I have to open Duo Mobile to get a passcode to sign in. If I have five different Instagram accounts, I repeat this process five time, and my Duo Mobile app end up with five different Instagram accounts listed. Nobody else is able to give me a code to log in to Instagram. - https://help.instagram.com/566810106808145
So is this your scenario? "I have a TikTok account with username "xyz. I want to let an external person, Mary Lastname, log in to TikTok as "xyz" without having her know the password. I will share the password for the "xyz" user with Mary via Lastpass, but not let her view the password. When Mary Lastname logs in to TikTok as "xyz" she can go to the account settings and add Duo Mobile on her phone as an authenticator app to generate passcodes. I expect I can continue to manage the "xyz" account as well and that I can remove Mary's access to the account."
That, I think, is not an entirely valid scenario, because it would depend on if TikTok (or whatever) permits a single account to have multiple methods of two-factor authentication functioning concurrently. If it does not, as soon as Mary sets up two-factor authentication for the "xyz", using Duo or not, you would no longer be able to log in as "xyz" because you do not have access to Mary's phone to generate the passcode needed to sign in.
4. Now I don't know what to say here, because I can't tell if you are talking about Duo cloud-service managed accounts or third-party accounts in Duo Mobile. But yes, in use cases where Duo bypass codes are a valid 2FA factor, deleting the bypass code prevents login.
Duo, not DUO.
