Hi @adam20,
Thanks for the replies.
When the user tries to log in, they will see this error in the URL: https://{my-server-domain}/?error=access_denied&error_description=Your%20password%20has%20expired.%20%20Please%20reset%20it.&state={state variable}
The user will continue to see the error in the URL until they have reset their password.