Great script. I had to add additional scope to graph to get mine to get it to run.
Added Directory.Read.ALl, Group.Read.All, GroupMember.Read.All, DeviceManagementServiceConfig.Read.All
New line: $graph = Connect-MgGraph -Scopes DeviceManagementConfiguration.Read.All, DeviceManagementApps.ReadWrite.All, Directory.Read.ALl, Group.Read.All, GroupMember.Read.All, DeviceManagementServiceConfig.Read.All