Do you have GRace Logins allowed?  This is set on the OU containing the users.  Look at it in iManager/IDConsole and check the # of grace logins

UA is supposed to redirect you to SSPR to fix the issue.

Hi Geoffrey,

by default the grace login did not enabled and i didnt set any grace login. Do i need to force periodic password change to let the user application expire the user password?

This is one of the odd places where the pre-NMAS password policies and the post overlap.

You would use a Password Policy to set the expiration times not here.

However I am not sure why the logins continue to work then... If you found a user who did login that way, look at their user object for anything about GraceLogins.  Perhaps it is inheriting from higher up.

Hi Geoffrey,

as per password policy i did not set the grace period, by default i should be configure over here instead of the container itself? 
just to understand more, the policy between user application & SSPR is not sync as they are 2 different entity?

It is not UA/SSPR issue. It is all an eDir issue. The original eDir design used RSA private/public key pairs.  Very secure but not case sensitive.  To add more modern password support NMAS was added to the client and server to implement Universal Password which added a lot more complexity options.

So the current password policy is almost exclusively in the UNiversal Password policies, except the grace login bits. Those are still a per-container policy.