This list doesn’t include all @Microsoft properties, just second-level domains that load on HTTPS, plus microsoftonline.com and windows.net, which load on HTTPS with some subdomains only.
I collected them by combining two Office configuration files12 and regexing the domains only, then keeping only the second-level domains that didn’t fail on HTTPS.
These are in alphabetical order except the first entry, whence @1Password supplies its rich icon.
microsoft.com
azure.com
bing.com
dynamics.com
hotmail.com
iis.net
live.com
microsoftonline.com
microsoftonline.us
microsoftstream.com
msn.com
office.com
office.de
office365.com
office365.us
officeppe.com
onedrive.com
onenote.com
outlook.com
powerbi.com
sharepoint.com
skype.com
virtualearth.net
windows.net
app://com.microsoft.Word