Thank you for your feedback. We've confirmed this behavior of a 12h Refresh Token is impacting Microsoft Entra External ID, and it is specific to the Email OTP flow. It was caused by a change to Entra made for security. One workaround until it is addressed is to use a username/password flow.

Before relaxing the Refresh Token lifetime back to 90 days, the team currently has prioritized fixing Conditional Access for Session Controls in the Email OTP scenario. We are interested in your feedback, does your Email OTP scenario require Conditional Access policy such as MFA?