if we onboard a Windows Active Directory or other server in Azure VM, does the signals that the (VM endpoint) send to the Defender Endpoint URLs in cloud, go out throw the Internet or the connection remain inside Microsoft Datacenters?
It is need to open the following urls and Ports?
Service Description URL
Microsoft Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)
Used by Microsoft Defender Antivirus to provide cloud-delivered protection
Alternate location for Microsoft Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)
Used by Windows to send client diagnostic data; Microsoft Defender Antivirus uses telemetry for product quality monitoring purposes
The update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints:vortex-win.data.microsoft.com settings-win.data.microsoft.com
A VM needs access to these URLs, if they are in Azure or not. So if you would block internet access on an NSG level, your machine will not report properly.
You need to create whitelisting on the NSG or your firewall
