Something to consider is adding some default [`on_challenge`](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/azure/core/pipeline/policies/_authentication.py#L140) implementation to `BearerTokenCredentialPolicy` and `AsycnBearerTokenCredentialPolicy`. Potentially, could leverage the CAE claims handling that the [ARMChallengeAuthenticationPolicy](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-mgmt-core/azure/mgmt/core/policies/_authentication.py#L49) uses.