Azure DevOps self-hosted agents (Windows, Linux, or Docker) utilize a pull-based communication mechanism. They initiate an outbound connection to Azure DevOps Services via HTTPS (Port 443) to listen for job messages. Because the agent initiates the communication, no inbound ports from the Internet are required. To secure the environment, an explicit Allow rule for outbound port 443 is created, followed by a lower-priority Deny rule for all other outbound internet traffic (Action: Deny, Destination: Internet). This ensures the agent can communicate with the orchestration service while preventing data exfiltration or unauthorized external connections.

Microsoft Learn - Azure Pipelines: Communication with Azure DevOps Services. "The agent initiates a connection to Azure Pipelines... and communicates over HTTPS (port 443)." [Official Vendor Documentation]

Microsoft Learn - Virtual Network: Service Tags overview. Section: "AzureDevOps Service Tag." This tag simplifies NSG management by representing the IP address prefixes for Azure DevOps. [Official Vendor Documentation]

IEEE Xplore: Security Policy Management in Cloud Networks. DOI: 10.1109/ACCESS.2019.2925583. Discusses the implementation of "Default Deny" and "Least Privilege" in software-defined networking environments.

Stanford University (CS155): Network Security and Firewalls. Course materials detailing egress filtering and the security risks of unnecessary inbound openings in cloud-hosted runners. [University Courseware]