Hi
Thank you for your reply.
Based on information, we suspect that at the time of initial (First) password change the policy might not have assigned (effective) to user resulting during first time password change the password quality restriction might not have applied to user.
I hope the above information will help in answering your concerns.
Thank you
Regards
Nishant Shendre