Debugging 403 errors for failed Remediation run

[thetootall]

Im using the traces table from Application Insights to pull the logs below but I've double and triple-checked (even as far as rerunning the Add-MSIAppRoleAssignment.ps1 file after discovering I had put in the App Registration Object ID and not the Function App) and still are seeing these entries in log:

Ive also attached the 403 error (and added to remove sensitive information) for additional debugging
403-error.txt

[NickolajA]

Could you go to Azure AD > Enterprise Applications > (select Managed Identities from the type drop down) and search for your function apps name. Then check under Permissions to see if you have Device.ReadAll?

[JankeSkanke]

Here is how it should look in permissions on the managed identity. @thetootall