It sounds like you are testing the password reset functionality before allowing time for the ID to be harvested from the client. That should happen when the user next logs in.
For the scenario when you register the user and then add the vault policy the user gets vaulted (i.e. the id of the user gets uploaded to the vault) the first time they access and succesfully authenticate with the server. So you would not be able to change the user password until they initially accessed the server. When the user id has not been uploaded to the vault this is the message you get from password reset tool.
You can verify my theiry by opening the vault and seeing that there is no entry for that the user in the vault.
Once the user accesses the server, you will be able to change the password.