Generate Azure Policy Compliance Alerts By Sending Custom Data to Log Analytics - Part 2 - Automated

Hi, tryig to run it across MG. i deploy eventgrid on MG level, but failing to create eventgrid-sub, with error:

Deployment has failed with the following error: {"code":"Publisher Notification Error","message":"Failed to enable publisher notifications.","details":[{"code":"Publisher Provider Error","message":"GET request for
https://management.azure.com/tenants/xxx/providers/Microsoft.Management/managementGroups/xxxxx/eventGridFilters/_default?api-version=2020-10-01
failed with status code: Forbidden, code: AuthorizationFailed and message: The client 'xxxx' with object id 'xxxx' does not have authorization to perform action 'microsoft.policyinsights/eventGridFilters/read' over scope '/providers/Microsoft.Management/managementGroups/xxxx/providers/microsoft.policyinsights/eventGridFilters/_default' or the scope is invalid. If access was recently granted, please refresh your credentials.."}]}

the  The client 'xxxx' with object id 'xxxx' is an enterprise app

any idea?