Our DEP setup is with local accounts and we include the Passcode payload in the PreStage so that during account creation the user must meet a complexity requirement. There is also a maximum passcode age set in the PreStage and I've noticed the management account and any other hidden local admin account are subject to a password that expires (because PreStage is system level)
Using a User Level Config Profile with a Passcode policy somewhat fixes this, but the user can use a simple password at setup and doesn't have to change it until it expires...
Anyone else seeing this?