Enforce Password Change for NEW user and new Azure AD joined device

Hi All,

I would like to check if user can be forced to change the password during device enrollment.

1. We have new users who would be issued new Autopilot laptops, issued with AD ID's & temporary passwords and these users enroll into these Laptop with their Azure AD accounts.
2. In this process, device would be joined to Azure AD, followed by Intune enrollment.
3. The plan is to create these users in on-premise AD and sync them to Azure AD.
4. The expectation now is to enforce password change, since this is users first login. How do we achieve this ?

In General, How do we enforce password change for a new/first time user who is using Azure services like Office365 webportal or Intune who gets authenticated on Azure AD ?? And if these AAD accounts are synced from on-prem AD ?

From what I heard, selecting "change password at next logon" on On-prem AD, and then sync those accounts up to Azure AD using AD Connect is not a possibility ?

For synced AAD users is there a way for users to be prompted to change their password on the O365 web portal/Intune enrollment and then write those changes back to the on-premise AD ?

Thanks in advance.