I was recently involved in troubleshooting an issue where an on-premis exchange deployment was bouncing e-mails with an error that the user did not have an MDB assigned. This was a multi-tenant exchange deployment, so we could not use the official hybrid mode, but we were using one of the sync tools to keep usernames and passwords for the local users in sync with the office 365 users.
activedirectory
Windows password policies through GPO are applied at the computer level. If a GPO is with a computer password policy is applied at the top “domain” level, it affects all users in AD. If a GPO with a computer password policy is applied at an OU level, it affects all local accounts on any computer that is in the affected OU tree.