Question with regard to DR strategy

[GregHowley]

From what I understand, if the datacenter where my primary is hosted goes down, I have to promote one of my offsite replicas to primary for DR in order to authenticate users.  Is this correct?

In light of the last year of working strictly remotely, how does one do this if RSA is our VPN MFA?  

[StevenSpicer]

The replicas will continue to authenticate users even if the primary is unavailable.  Promoting a replica to primary is necessary to restore administration functions.  Note the during the promotion, the replica being promoted cannot authenticate, so you really need two replicas to have continuous authentication availability.