You can set your DualShield IIS Agent to bypass MFA when your DualShield is offline

In the IIS Manager, select the Microsoft-Server-ActiveSync application node