Can I force a password change?

When I create a new user, I would like to force that user to change their password on first log in, can this be done?

Not out of the box, but you could implement it by:

Adding a user meta on user create.

Dropping that meta on user password update.

Redirecting the user to his profile page, from anywhere else, if the user meta is around.