I realize this question is very old, but I did run a test to verify it works correctly in a current 16.04 Ubuntu image.
lxd can be used to very quickly create instances and test cloud-init configurations. Assuming you already have lxd set up, I did:
$ cat ud.yaml
#cloud-config
# Add groups to the system
# The following example adds the ubuntu group with members foo and bar and
# the group cloud-users.
groups:
- ugroup
# Add users to the system. Users are added after groups are added.
users:
- default
- name: user
gecos: Testbed as a Service
primary-group: ugroup
groups: admin
passwd: $6$rounds=4096$4pFvtqM5ldfLzR0hE9r7XSOoCO22lN7OB49IopWQ7SQrB5GBTR8X8okMpxXXQZ0jqUOuy4wKY.iYzwQTo7vH6zKx0DqjTFe6jh1
runcmd:
- [passwd, user, '-u']
$ lxc launch ubuntu-daily:xenial xuser-test \
"--config=user.user-data=$(cat ud.yaml)"
$ lxc exec xuser-test /bin/bash
# ls -l /home/
total 2
drwxr-xr-x 3 ubuntu ubuntu 6 Jul 18 18:47 ubuntu
drwxr-xr-x 2 user ugroup 5 Jul 18 18:47 user
# tail -n 2 /etc/group
ugroup:x:1000:
ubuntu:x:1001:
# tail -n 2 /etc/passwd
ubuntu:x:1000:1001:Ubuntu:/home/ubuntu:/bin/bash
user:x:1001:1000:Testbed as a Service:/home/user:
# grep passwd /var/log/cloud-init-output.log
passwd: password expiry information changed.
If this is still a problem for you, please file a bug against cloud-init.