I have registered an application in an Azure AD B2C tenant for testing purposes. I am using this app for user authentication via the Authorization Code Grant flow with PKCE.

During the exchange of the authorization code for an access token, I receive additional tokens such as profile_info and refresh_token along with the access_token. I only need the access_token and ID_token.

I have attempted the following steps to exclude the refresh_token:

Removed offline_access from the scope, as I understand this should prevent the generation of a refresh token.
Completely removed openid and offline_access permissions from the app’s API permissions.
Ensured that only the User.Read permission is granted.
Despite these steps, I continue to receive the refresh_token in the response. According to Microsoft documentation, excluding offline_access should prevent the generation of a refresh token, but this is not working as expected.

How can I configure my ADB2C application to only receive the access_token and ID_token, and exclude the refresh_token and profile_info?