My question is, do we have any documented method of granting a Manage Service Identity permissions to the Graph API as we would with an Azure App Registration in the portal?
The RequestDenied message is expected. There was a change to this that updating the System MSI SP is now blocked.