ADFS RefreshToken rotation with MSAL - jwt

Question

Environment
.NetCore 3.1 Client
ADFS 2019
MSAL via Microsoft.Identity.Client, Version=4.18.0.0
I'm using MSAL to authenticate directly to a customer ADFS 2019 instance using the ROPC flow (username/password) for a .NetCore desktop client. I'm able to get an IDToken & RefreshToken at initial login, and then MSAL (which keeps the RefreshToken privately under wraps) will acquire new IDTokens for a period of time until the RefreshToken expires.
My question is, is there a way for me to get ADFS to issue a new RefreshToken or do RefreshToken rotation while I continue to want to be signed in? Currently, once the default 480 minutes passes - during which new IDTokens are issued correctly - the call to .AcquireTokenSilent() fails with MsalUIRequiredException "The refresh token in parameter 'refresh_token' has expired".
Microsoft says here that adding the 'aza' scope will force a RefreshToken update (if using OAuth2.0 extensions ?), but that's not what I see (hence why it's commented). When I add the 'aza' scope, I do get a new IDToken on every request instead of it hitting the local account cache, but no new RefreshTokens come back. I'm verifying this with ngrok looking at the traffic to my ADFS instance.
static void Main(string[] args)
{
app = PublicClientApplicationBuilder.Create("CLIENT_ID")
//.WithAuthority(AzureCloudInstance.AzurePublic, TenantId)
.WithAdfsAuthority("ADFS_URI", false)
//.WithExtraQueryParameters(new Dictionary<string, string> { {"forceRefresh", "true" } })
.Build();
while (true)
{
var result = GetToken().GetAwaiter().GetResult();
Console.WriteLine($"IdTok: {ComputeSha256Hash(result.IdToken)}, Exp: {result.ExpiresOn}");
Thread.Sleep(1000 * 60 * 2);
}
}
private static async Task<AuthenticationResult> GetToken()
{
var accounts = app.GetAccountsAsync().GetAwaiter().GetResult();
if (accounts == null || accounts.Count() == 0)
{
var result = app
.AcquireTokenByUsernamePassword(new string[] { "email", "openid"/*, "aza"*/, "allatclaims", "profile" }, "TESTUSER", ConvertToSecureString("TESTPASS"))
.ExecuteAsync().GetAwaiter().GetResult();
accounts = app.GetAccountsAsync().GetAwaiter().GetResult();
}
var cachedResult = app.AcquireTokenSilent(new string[] { "email", "openid"/*, "aza"*/, "allatclaims", "profile" }, accounts.FirstOrDefault()).ExecuteAsync().GetAwaiter().GetResult();
return cachedResult;
}
Initial Login response Includes IDToken & RefreshToken
Subsequent Responses only include new IDToken
Until the RefreshToken is Rejected