Password expired but "Change password not allowed on specified user"

The issue was the user matched a custom password policy rule that did not have any of the self-management options checked: