Grant-AzureADAppSitePermission.ps1

#requires -modules "PnP.PowerShell"

# permissions required SharePoint > Application > Sites.FullControl.All

    Connect-PnPOnline `
        -Url         "https://$env:O365_TENANT-admin.sharepoint.com" `
        -ClientId    $env:O365_CLIENTID `
        -Thumbprint  $env:O365_THUMBPRINT `
        -Tenant      $env:O365_TENANT `
        -ErrorAction Stop

# config

    $applicationId = ""
    $displayName   = ""
    $siteUrl       = ""
    $permission    = "Read" # "Read" "Write", "Manage", "FullControl"


# permission grant

    if( $permission -match "Read|Write" )
    {
        Grant-PnPAzureADAppSitePermission -AppId $applicationId -DisplayName $displayName -Site $siteUrl -Permissions $permission -ErrorAction Stop
    }
    elseif( $permission -match "Manage|FullControl" )
    {
        $appPermission = Grant-PnPAzureADAppSitePermission -AppId $applicationId -DisplayName $displayName -Site $siteUrl -Permissions Write -ErrorAction Stop

        Set-PnPAzureADAppSitePermission -PermissionId $appPermission.Id -Site $siteUrl -Permissions $permission
    }