This is in regards to Scenario 2 and 3. What is the difference between these cmdlets.
Connect-IPPSSession
Connect-IPPSSession -ConnectionUri https://ps.protection.outlook.com/powershell-liveid/
Connect-IPPSSession -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/
The middle one (protection) seems to be doing Connect-ExchangeOnline in disguise (Get-Mailbox is working, but not Get-Compliance*). Hence its bit confusing on why exactly it would be required. In that case we should be able to use Connect-ExchangeOnline with compliance URL to connect to S & C as well (doesn't connect). Or its it the same cmdlet, with default predefined Uri embedded in it.