What is a Bypass Code?

 SurePassID Windows Logon Manager (WLM) Bypass Code is a special override code that can be used in place of a one-time passcode (OTP) during Windows logon when WLM is enforcing MFA. According to the SurePassID knowledge base, the bypass function is implemented through a Master Passcode Override configured in the WLM Configuration Manager.  

How it works

1. In the WLM Configuration Manager, an administrator enables Allow Master Passcode Override.
2. The administrator enters a 10-character code (numbers, letters, and/or special characters).
3. When saved, a hash of the code is recorded. 
4. The resulting registry entry can be:
   • Exported and imported to another machine, or
   • Deployed through Group Policy (GPO) or another management tool. Once the hash is present on the workstation, the configured bypass code can be entered instead of an OTP during authentication.  

Typical use cases

The article explicitly states that the bypass code can be used in place of an OTP.

Common scenarios where organizations often use this type of capability include:

• A user cannot access their MFA device.
• Lost or damaged token.
• Emergency access during token replacement.
• Break-glass access for supported systems.

Typical Windows Login Flow

1. User enters their Windows username and password.
2. Windows Logon Manager (WLM) prompts for MFA authentication.
3. Instead of entering the expected OTP from a hard token, soft token, SMS, or other configured authenticator, the user enters the configured bypass code.
4. WLM validates the bypass code against the locally stored hash.
5. If valid, the MFA step is satisfied and Windows logon continues. 

Important security consideration

Because a bypass code can substitute for the normal OTP challenge, access to the configuration, registry deployment, and the code itself should be tightly controlled and should be stored in a password vault (with MFA of course) and periodically rotated via one of the supported automated deployment options.