Hi,
I was also trying to make the groupMembershipFilters work and discovered a bug where the filter is not evaluated when the Role schema is not part of your application definition and/or the ‘roles’ attribute is not in the account schema. Looking at your app xml, it looks like this is also the case for you.
Please take a look at the full description I posted in the bugs section and see if you can make it work:
EntraID Group Membership Filter not evaluated - Feedback / Bugs - SailPoint Developer Community
Kind regards,
Pieter de Loos.