Can anyone explain the dirrent ways of handling expired or changed passwords ?

I'm hoping that if I use GMS as a "Trusted App" the devices will still sync even when the users can not login :-)