Active Directory Password sync over ZTNA

All of our Windows Laptops are joined to our Active Directory domain when we send them out to users.  With VPN a user could change their AD password and the password would sync to the Laptop over VPN while connected.  Now that we are changing over to ZTNA there is no VPN for users to sync their AD passwords.   I could setup a proxy (more like 10 proxies) for all the ports needed by AD to allow password syncing but this sounds a bit over kill.  There must be a solution that others have come across to do this.