Azure AD has a limitation where it only allows sending group membership in a single SAML attribute, which is already used by idpGroups. This can prevent you from properly mapping user groups to your Checkout.com roles.
The best way to resolve this is to use custom roles in Azure AD. This requires an Azure AD Premium P1 or P2 license.
Create and assign custom roles to the users or groups you need. Then, in your SAML claim, map these roles to the idpEntities attribute as follows:
Attribute name:
idpEntitiesValue:
user.assignedroles
Alternatively, you can map a single-value user property, like department, to idpGroups (since usually a user is assigned to one role only) and use the user groups for mapping the idpEntities (since usually one user has access to multiple entities).