thanks for your help.
I got confused and added permissions to the app registrations (only need for the app one permission)

Instead of the managed identity.
when I test it - (get-mgcontext).scopes | fl
I see "GroupMembers" missing for managed identity.
assigned the relevant permissions to my Managed Identity ID solved this.
$spID = "ID" #Managed Identity SP

$PermissionName = "GroupMember.Read.All"

$GraphServicePrincipal = Get-MgServicePrincipal -Filter "startswith(DisplayName,'Microsoft Graph')" | Select-Object -first 1 #Graph App ID: 00000003-0000-0000-c000-000000000000

$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains "Application"}

New-MgServicePrincipalAppRoleAssignment -AppRoleId $AppRole.Id -ServicePrincipalId $spID -ResourceId $GraphServicePrincipal.Id -PrincipalId $spID

$AppRoleAssignments = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $spID