Creating the M365 group with Sensitivity Label starts the modern Team site with desired protection. This can be done with SPO Rest API or Microsoft Graph API, both require delegated permissions.
...
Updated Jun 13, 2022
Version 2.0
Blog Post
ah, would be great is this supported app-only token, every other PnP.PowerShell cmdlet I've used in a provisioning process supports app-only permission - but Set-PnPSiteSensitivityLevel only support delegated permissions...