Great stuff!

My setup is slightly different but I managed to get it to work!

I'm using a Unifi Security Gateway (USG) and I wanted to set the IP for my root domain, which in DNS speak is @. So to get it to work I changed the strZone regex to: "^([a-zA-Z@]{1,})(.)([a-zA-Z.]{1,})".

Then in the Unifi Controller interface I create a dynamic DNS record with @.domain.com as hostname (and the rest the same as Niels above). This fixes the updates between unifi and DNS!

The other things I needed to do to get my system working is setup letsencrypt with the azure-dns plugin, the plugin can be found here. Just follow the instructions there, but I did need to create a seperate service principal in my azure AD, so make sure you are able to do that!

Finally two minor tips:

1. I use a lot of subdomains and in my old solution for this I just had a list of those that I had some code loop through, so those were all A records with the IP address, in the DNS Zone in Azure you can do it smarter (and with that you only need 1 dynamic DNS record in Unifi) and that is to set the subdomain as A records with the Alias record set set to yes and pointing to the record that gets updates (@ for me). This aliasing is smarter then regular CNAMEs in DNS because it does return the IP address that it points to rather than having to do 2 lookups!
2. you can SSH into your USG and then run these two commands once you have the dynamic DNS setup in the portal, to force the call to your function: update dns dynamic interface <interface, in my case eth0> and then to check the outcome: show dns dynamic status. If you are unsure of the interface run the second one first and then you will see the interface!