You're using your organization's MDM solution to change the password of a managed administrator account...

On macOS, aSecureToken-enabled accountis tied to FileVault and other cryptographic functions. Apple Learning specifies that when MDM is used to change the password of a managed administrator account that already has SecureToken, both thelogin passwordand theSecureToken passwordare updated together. This synchronization is critical because a mismatch between login credentials and SecureToken would lock the user out of decrypting the FileVault-protected volume. Apple designed MDM password management to handle both elements in tandem to prevent account lockout and ensure continuity of access. Options suggesting only one password is updated, or that the change cannot occur, contradict Apple’s documented behavior. Therefore, both the login and SecureToken passwords are updated simultaneously when the change is pushed through MDM.