JAMF Log in Lock out

Hey all!

Just wondering if anyone has had a similar issue where they've deployed CIS benchmarking specifically CIS lvl1 (passwordpolicy) in JAMF for devices on Tahoe, and when users are upgrade to Tahoe from Seqouia they are locked out and are unable to login? this was advised to be implemented by our sec team whilst also having jamf connect

they are jus locked out on the default mac log in screen, we have a work around of going into recovery and resetting password but do not get why they are locked out as if it was the policy i was advised it should ask the user to reset their password if does not align with the cis password policy