Password change at Next Login with ISE and PaloAlto

i am using Duo in global protect portal when connecting as a remote VPN user. I am using ISE as 1st authentication and Duo as second authentication. i need to create users at ISE and set their manual password.
can i set option of '‘password change at next login’ in ISE. because when i enabled this option in ISE then my authentication failed.
do i need to change some paramters in Auth-Proxy conf file.