PnP-PowerShell Connect-PnPOnline using AppId gives Access denied

I finally figured this out. The Connect-PnPOnline cmdlet is flexible and has multiple ways to connect to SharePoint. They key is using the right set of parameters.  

Using the syntax "Connect-PnPOnline -Url $siteUrl -AppId $appId -AppSecret $appSecret" connects using SharePoint App-only permissions as described https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs. Using this method you need to register the app using SharePoint (not the graph).  If you want to connect using the Microsoft Graph and Azure AD the connection string would be something like "Connect-PnPOnline -AppId $appid -AppSecret $appsecret -Url $siteUrl -Scopes Sites.FullControl.All".