Yup. The VLAN-related config is a slight mess. The bridge interface (to which said IP address is bound) is untagged member of VLAN 1 (the implicit default configuration is to have every interface, including bridge interface set with pvid=1).
Read article about different bridge personalities. You have to treat bridge interface as bridge member port to make interaction of ROS with VLANs possible. In particular, you have to move IP setup (address, …) from bridge interface to interface MGMT99.
For MAC access via winbox, check configuration under /tool mac-server … by default access is allowed via LAN interface list, you might want to change it to MGMT99 interface or create another interface list with MGMT99 member or add MGMT99 to LAN interface list (whichever suits you best).