"Access token validation failure. Invalid audience." when trying to connect to MS Graph

[NigelWit]

Hi - Im using Pnp.PowerShell v1.4.0 and trying to connect to the MS Graph. I have configured a Service Principle (as per https://dev.to/svarukala/introducing-the-new-pnp-powershell-based-on-net-core-3-1-and-learn-how-it-s-authentication-works-pn7) by running:

Register-PnPManagementShellAccess

Then getting tenant admin to consent to the required permissions:

I then authenticate using credentials stored in my local (Windows) credential manager, get a token and make a graph call:

Connect-PnPOnline -Credentials "<<Cred - Internet or Network Address>>" -Url "https://<<Tenant>>.sharepoint.com"
Get-PnPWeb # Just a test to see if authenticated - returns the web as expected
$token = Get-PnPGraphAccessToken
$graphHeader = @{ Authorization = "Bearer $($token)" }
$url = 'https://graph.microsoft.com/Beta/groups'
Invoke-WebRequest -UseBasicParsing -Headers $graphHeader -Uri $url

at this point I get the error:

I assume this is because I am not really authenticating using the Service Principle, as I am able to resolve PnP cmdlets, but getting fail when calling Graph Web end points? I dont get how my call to Connect-PnPOnline is invoking the service principle. Should I be calling Connect-PnPOnline a different way, or is the issue with the permissions on the Service Principle

Many thanks for any assistance offered :D