I have been finding examples of filtering on individual principal names but silence on AD groups.  It seems like if it was possible I would be able to find documentation...

The point of filtering on an AD group is to capture the actions of all the members of the group, rather than name specific users.