- [ ] AT lifetime is configured at AAD level, but could emulate with forced refresh - [ ] POP - especially ATPOP is not generally available. Maybe fake it for now?
