Trying to use Get-SPOTenantSite with Azure AD App Permissions

[bjpohl]

Trying to automate some tasks using PNP and run into a stumbling block with Get-PnPTenantSite. If I follow the directions in this helpful page, I am able to Connect, but when I get "Get-PNPTenantSite" the error, "Current user is not a tenant administrator.

I am using an app secret instead of a certificate, but believe most everything else is set up correctly, as I can use Get-PnPTenantSite successfully if I provide authorization in SharePoint instead, as described here (with the exception of using "FullControl" vs. "Manage" as it is demonstrated). I would just like to use Azure AD authorization vs. SPO app authorizations, if possible.

I can obviously provide more details if necessary. Just trying to initially see if I missed some documentation on the subject. Thanks.

[bjpohl]

Well, I found some new information around this that I have used to meet my needs, but will update this thread in case it helps someone else:

• If I use this signature for Connect-PnPOnline, I can not use AzureAD permissions to grant Tenant administration, however I have been successful using SharePoint App-only authorizations:
  Connect-PnPOnline -ClientId '<id>' -ClientSecret '<secret>' -AADDomain 'contoso.onmicrosoft.com'

• Weirdly, if I use this signature, the opposite seems to be true: I can run Tenant-admin command by granting AzureAD permissions, while SharePoint App-only authorizations seem to be ineffective:
  Connect-PnPOnline -Url https://contoso.sharepoint.com -ClientId '<id>' -Tenant 'contoso.onmicrosoft.com' -Thumbprint 34CFAA860E5FB8C44335A38A097C1E41EEA206AA