I’m using Microsoft Graph API to read my end user group membership and assign appropriate authorization in my ASP.NET MVC web app. I’m using Entra app registration to generate access token and leverage the bearer token in subsequent Graph API end points and not use Client Secrets and prefer User assigned managed identity, what are the permission levels needed for my Entra app and managed identity to access below end point ?

End point I needed access to: https://graph.microsoft.com/v1.0/users/{objectID}/memberOf?$select=id,displayName and
https://graph.microsoft.com/v1.0/users/{objectID}

Error message I receive: Unhandled Exception: System.Net.WebException: The remote server returned an error: (403) Forbidden.