Hi Garvie,
As for:"Since they never use their local account, they do not know their local password. That being said once their password expires locally they wont be able to log in to their cloud account according to documentation. They don't log on locally so they don't get notifications of account expiration/password change.", you can set their cloud passwords to never expire to avoid the situation.
If a user is under Password Sync, their cloud account password is set to "Never Expire". This means that it is possible for a user's password to expire in the on-premises environment, but they can continue to log into cloud services using this expired password.
The cloud password will be updated the next time the user changes their password in the on-premises environment.
As for:"The password sync feature will sync every password for users that are being synced. From what I read you cannot exclude certain users (All or nothing). This is true correct? If so maybe there is a future enhancement.", yes, we can't exclude certain users. We can only uncheck the checkbox to disable the password sync:
However, it is really a good and considerate suggestion.
So, I suggest you submit feedback to our product team about your suggestion. Our feedback analysis specialists will evaluate the advice you provided. So far, many features are improved based on customers’ feedback. This will help our product to be designed better. Thanks for your effort and contribution.
Best regards,
Jerry Cen