SQL Login authentication on Always-On instances.

Hi Folks

My first query on Always-On. 

I have replicated SQL logins from PRIMARY instance to SECONDARY instance via Powershell using dbatools.

Users are allowed to login to secondary instance only. 

I have 2 queries. 

1. How to allow user's to change their password. 

2. Is it possible to allow user's to change password from secondary instance? Since all changes has to be performed and synced from Primary instance. 

Thanks

Vijay