How to handle expired access tokens in the Microsoft identity platform using least-privilege authentication?

Implementing a least-privilege security model requires that applications request only the specific scopes necessary for a task. In the Microsoft identity platform, access tokens have variable lifetimes, typically ranging from 60 to 90 minutes, after which they expire and the client must acquire new tokens.

When using a public client, such as a single-page application (SPA), there is uncertainty regarding the most efficient way to manage these expirations without forcing frequent interactive user sign-ins. While refresh mechanisms exist to acquire new tokens silently, the interaction between token lifetime variation and sign-in frequency settings can complicate the session experience.

How can a client application verify if a cached token is nearing expiration and trigger a silent renewal? What is the recommended process to verify that a renewed token still adheres to the original least-privilege scopes? How can a developer verify that the silent renewal was successful without triggering a full interactive login?