If you’re using multifactor auth, the usual login method mentioned in the SPOService documentation isn’t going to work (using Get-Credential) and you’ll get an error saying “Connect-SPOService : The sign-in name or password does not match one in the Microsoft account system”.
The correct process is rather bizarre:
$orgName = “organizationname"
connect-sposervice -url “https://$orgName-admin.sharepoint.com"
Then you’ll get the same Azure AD auth popup that you’d get with Connect-AzureRmAccount and Microsoft’s other Powershell modules. The only place I could find this was in Microsoft’s docs here, but it would have saved me some time if it was at least mentioned in the help text for Connect-SPOService…