list of the custom Permission is required to implement the Azure policy at management group level

To create a custom role that allows assigning Azure Policy at the management group level, you'll need to include specific ARM permissions related to:

• Reading and writing policy definitions and assignments
• Reading and managing management groups
• Assigning roles (if necessary)

Here are the minimum required actions to include in your custom role:

"actions": [
  "Microsoft.Management/managementGroups/read",
  "Microsoft.Authorization/policyDefinitions/read",
  "Microsoft.Authorization/policyDefinitions/write",
  "Microsoft.Authorization/policySetDefinitions/read",
  "Microsoft.Authorization/policySetDefinitions/write",
  "Microsoft.Authorization/policyAssignments/read",
  "Microsoft.Authorization/policyAssignments/write",
  "Microsoft.Authorization/policyAssignments/delete"
]

If your policy assignment includes a managed identity or you want to allow role assignments, include:

"Microsoft.Authorization/roleAssignments/write",
"Microsoft.Authorization/roleAssignments/delete"

Set the AssignableScopes to a management group scope, like this:

"AssignableScopes": [
  "/providers/Microsoft.Management/managementGroups/your-mg-id"
]

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin