World of EUC

You can do change password via gateway when they expire or change password is set on account.

Do you want it on demand or just when expires/set to change?

Both. for external users with only the storefront web portal through netscaler access...

On demand could publish a tool/shortcut. Expired or set to change will work via Gateway. You’ll need TLS or SSL to LDAP to support change password via Gateway 

Azure AD SSPR with write back through Azure AD connect into the on-prem AD :)

That's one of the options I told them about. Requires AD Premium sub...

<@UK6S90JDR> yes, that's the other option. Just found a relatively cheap tool that does that... <https://store.unosquare.com/passcorepro>