CloudPasswordPolicyForPasswordSyncedUsersEnabled

For password-hash-synchronized users, do not rely on the on-premises “Password Never Expires” flag as a cloud exemption after enabling CloudPasswordPolicyForPasswordSyncedUsersEnabled. Microsoft documents the cloud exception separately through the user’s PasswordPolicies attribute.
Enabling the feature does not immediately remove existing DisablePasswordExpiration values. Microsoft says removal occurs at the next password hash synchronization following that user’s on-premises password change; newly synchronized users do not receive the default exemption. Consequently, an account may initially appear exempt without its on-premises flag being the reason.
Inspect the user’s cloud PasswordPolicies value and the expiration policy for its verified domain. If a cloud exemption is required, explicitly configure DisablePasswordExpiration for that account using Microsoft Graph, with approved permissions.
Verify again after relevant synchronization events. Microsoft also documents that a full password hash synchronization associated with Entra Domain Services can clear these values, requiring exemptions to be reapplied. Test with a noncritical account before changing production-wide settings.