FortiAuthenticator agent: no visibility to domain controller

Hello,

I have some doubts about FortiAuthenticator Agent and 2FA with Windows logon: the documentation says that the agent (installed on the endpoint) needs to contact the domain controller using LDAP (i infer this from TCP/389).

So... what happens if the user is away and it's endpoint can't contact the domain controller? The documentation is not very clear about this.

Thanks