Mask the generated password when updating expired password

[BuckSwish]

For security purposes on shared passwords, would like to have the ability to have the "generated password" that appears when a password needs updated to be Masked and only the apply button availble based on security roles (Modify as example). Looking at updating a shared password without an admin involvement but the end user not knowing the shared password ever.