I want to be able to refresh tokens generated on behalf of a service principal via Token Management API, just like with any other service where OAuth is used and refresh token endpoint is available.

Allowing indefinite or very long expiration for access tokens is not a great solution and would raise concerns during compliance audits, while shorter expiration means automation pipelines will stop working often, requiring admin user to login via SSO and call the API again to generate a new token.