I am configuring my application to handle the following scenario: When I create a new user as an admin, a temporary (random) password is generated for that user. After the user logs in for the first time, they are required to change their password. This requirement is tracked using the MustChangePassword field in the AppUser : Identity class.