The default password lifetime on an Azure AD Domain Services managed domain is 90 days. This password lifetime is not synchronized with the password lifetime configured in Azure AD. Therefore, you may have a situation where users' passwords expire in your managed domain, but are still valid in Azure AD. In such scenarios, users need to change their password in Azure AD and the new password will synchronize to your managed domain. If you want to change the default password lifetime in a managed domain, you can create and configure custom password policies..
Additionally, the Azure AD password policy for DisablePasswordExpiration is synchronized to a managed domain. When DisablePasswordExpiration is applied to a user in Azure AD, the UserAccountControl value for the synchronized user in the managed domain has DONT_EXPIRE_PASSWORD applied.
When users reset their password in Azure AD, the forceChangePasswordNextSignIn=True attribute is applied. A managed domain synchronizes this attribute from Azure AD. When the managed domain detects forceChangePasswordNextSignIn is set for a synchronized user from Azure AD, the pwdLastSet attribute in the managed domain is set to 0, which invalidates the currently set password.