Change Per OU:
Get-ADUser -Filter * -SearchBase “cn=users,dc=cpg,dc=cityprogroup,dc=com” | Set-ADUser -CannotChangePassword:$false -PasswordNeverExpires:$false -ChangePasswordAtLogon:$true
OR
Connect-MsolService
Get-MsolUser -All | Set-MsolUserPassword -ForceChangePasswordOnly $true -ForceChangePassword $true