What ports are required to restore objects and attributes in the on premise environment using the hybrid feature in On Demand Recovery (4302643)

What ports are required to restore objects and attributes in the on premise environment using the hybrid feature in On Demand Recovery

On Demand Recovery has a hybrid feature which allows objects/attributes to be restored in the on premise environment. This feature works by utilizing a service called "Quest Recovery Manager Portal Access" which gets installed with Recovery Manager for Active Directory. This solution article outlines how the On Demand module connects to the service in the on premise environment. 

When performing a restore in On Demand Recovery which includes objects/attributes which exist in the on premise environment the On Demand module contacts an "Azure Relay" service which is configured in the Quest Azure tenant. The"Quest Recovery Manager Portal Access" service in the on premise environment then contacts  "Azure Relay" service in the cloud over HTTPS (port 443). The connection only needs to be opened from the on premise Recovery Manager server to the "Azure Relay" service in the cloud. Incoming connections to the Recovery Manager server can be blocked.

The best approach is to whitelist the DNS name for the Azure WCF Relay, opening only port 443 to *.servicebus.windows.net

Outgoing connections from the Recovery Manager server to the "Azure Relay" service can also be limited to only Azure Datacenters by IP Ranges, however it is possible for the IP addresses to change. For more information on these ranges, please see https://www.microsoft.com/en-us/download/details.aspx?id=41653