Question

Your company deploys Azure Firewall Standard to control outbound traffic from a spoke virtual network. Server administrators report that Windows Update fails on all VMs because outbound HTTP/HTTPS is denied by default. The Microsoft-hosted update endpoints span many changing FQDNs and CDNs. You must allow Windows Update traffic with the least administrative effort and without manually maintaining a list of URLs. What should you configure?

Accepted Answer

Create an application rule that uses the WindowsUpdate FQDN tag

Answer

Create a network rule allowing TCP 80 and 443 to the Internet service tag

Answer

Create an application rule listing each *.windowsupdate.com and CDN wildcard FQDN manually

Answer

Create a DNAT rule to redirect update traffic to an internal WSUS server