Can APM Active Directory expired password reset functionality be turned off?

Yes, I have it set to disabled. But that setting only controls whether the user gets prompted before their password expires. It doesn't affect what happens once their password is actually expired. In that case, APM always has them try to reset it.

My other thought was setting the "Max Password Reset Attempts" to 0, but in the GUI zero isn't an option in the dropdown. Only the numbers 1-5 are options.

So I still can't find any way to turn it off, unless it's possible to set it to 0 manually via TMSH or bigip.conf (but I was a little nervous about trying that since I don't know if that's a supported configuration).