Why does Visual Studio keep using stale permissions after my Azure role changes?

I'm working in Visual Studio (2022, Enterprise edition) connected to an Azure DevOps organization and Azure subscriptions through a Microsoft Entra ID account. After my administrator adjusted my role assignments in the Azure portal, Visual Studio continued to behave as though the old permissions were still in effect for a noticeable period.

My understanding is that Visual Studio caches authentication tokens via the Account Settings manager and inherits role-based access from Entra ID only when tokens are acquired or refreshed. This raises a least-privilege concern in both directions: newly granted permissions may not appear, and revoked permissions may linger in the local credential cache across project contexts.

I want a predictable way to reason about this behavior without blindly signing out and back in every time access changes.

Which specific components in Visual Studio (Azure service connections, Azure DevOps, Cloud Explorer/Connected Services) rely on the cached token versus requesting a fresh one? When a credential is revoked or expires at the identity provider, what actually triggers the re-authentication prompt in the IDE, and is the delay documented? Does a manual sign-out/sign-in cycle fully clear the cached tokens, or does any state persist?