Create-ServicePrincipalForPnPPowershell.ps1

$PnPPowerShellAppId = "31359c7f-bd7e-475c-86db-fdb8c937548e"

# Connect to you Azure AD, use Global admin or equivalent account
Connect-AzAccount

# get graph access token for current user --need Global admin
$accessTokenInformation = Get-AzAccessToken -ResourceUrl "https://graph.microsoft.com"
$token = $accessTokenInformation.Token

# Create a new service prinicpal
$pnpServicePrincipal = New-AzADServicePrincipal -ApplicationId $PnPPowerShellAppId

# 00000003-0000-0ff1-ce00-000000000000 is the well know application id for SharePoint's service prinicpal
$spServicePrincipal = Get-AzADServicePrincipal -ApplicationId "00000003-0000-0ff1-ce00-000000000000"

# pass the necessary permissions that you need 
$requestedScopes = "User.ReadWrite.All AllSites.FullControl TermStore.ReadWrite.All"

$payload = @{
		clientId = $pnpServicePrincipal.Id
		consentType = "AllPrincipals"
		principalId = $null
		resourceId = $spServicePrincipal.Id
		scope = $requestedScopes
	} | ConvertTo-Json

# Assign and grant permissions
Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants" -Headers @{Authorization = "Bearer $token"} 
-Body $payload -Method "POST" -ContentType "application/json"