I agree with the change made. I think it's very unlikely that tenant admin would be interested in changing the expiry settings for profile picture URLs, and it feels like this would be exposing too much of the underlying infrastructure to them. I think it's also good to keep the list of tenant admin options as limited and manageable as possible.

If it does come up as a need, we can still flip this switch.