I have done it and its a pain initially. Azure team created the SP according to Citrix doc. SP had Contributor. If you use a web proxy you'll have some problems. When it fails, you should be able to capture the output into a text file and somewhat see where the failure is happening. FWIW the AD ID is your Tenant ID