Creating the M365 group with Sensitivity Label starts the modern Team site with desired protection. This can be done with SPO Rest API or Microsoft Graph API, both require delegated permissions. The following sample scripts use AAD App ROPC authentication flow, which is documented in https://docs.
Read more at https://bit.ly/3HhPRZT
Source: Microsoft Tech Community SharePoint Blog