Just got around to implementing AD accountExpures checks in the few places where it's ignored. Sad to see "There is no plan today to sync password expiration state (or disabled or lockout state, for that matter) from on premises AD to AAD" when finding out what others do