For what it's worth, yesterday I configured my ISE 2.2 to enable TACACS+ auth to a HPE switch. The TACACS Policy uses AD to authenticate and authorize. And when I logged in with a brand new AD user, the switch prompted me to change my password. This is because the AD guys forced password reset on initial login. But this is pretty useful for regular forced AD password changes - you get prompted on the device! I was not sure if the original question was asking about local ISE accounts or AD account auth.
