Looks good but I don't know what the domain value should be. I tried to leave it blank and "MicrosoftAccount" but I'm still getting 403.