Hello DGC @DGC
Domain policy can apply over VPN connection, but not sure in other way.
If you have to use SAP , you can create password reset option in RD Web access :
Here’s how enabling the RD WebAccess Expired password reset option
Allow Users to Change Expired Password via Remote Desktop Web Access on Windows Server 2016/2012R2
----------
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Best Regards
Karlie