SamlPasswordExpirationAdvanceWarningDays

This policy has no effect unless SamlInSessionPasswordChangeEnabled is true. If that policy is true, and this policy is set to (for example) 14, that means SAML users will be notified 14 days in advance that their password is due to expire on a certain date. Then they can deal with this immediately by doing an in-session password change and updating their password before it expires. But, these notifications will only be shown if password expiry information is sent to the device by the SAML identity provider during the SAML login flow. Setting this policy to zero means the users will not be notified in advance - they will only be notified once the password has already expired. If this policy is set, the user cannot change or override it.