Windows AD account password expired but user can still send/receive email and use Teams

Hi.

I recently discovered that some users with expired AD passwords are still working as if nothing has changed, which caught me by surprise. All the users affected do not use the VPN on a regular basis, or sign into Office 365. They all use desktop office for their email (Outlook) and chats (Teams). We are all still working from home.

It appears as if a user is only challenged to update their expired password once they physically authenticate against the domain controller(s). But what if they never do? This means a user with an expired password will continue to send/receive emails and send chats in Teams regardless of when their password expired, unless they perform some form of "logon".

I ran a PowerShell script to elucidate more and found that we have dozens of users in this boat. Some users have passwords that expired YEARS ago!

Is this by design? In that the password expiration attribute is pointless until said account actively connects or authenticates to the domain? Why is the "expiration" attribute not part of the user SID? I'm baffled.

We have on premise domain controllers which syncs out to Office 365 via ADSync and this is syncing fine with no errors, including password sync.

Any help appreciated.