Separate an allowed network rule from a listening destination service

Source facts

Microsoft’s outbound-troubleshooting examples include a case where source outbound and destination inbound security rules both allow communication, yet the destination port is unreachable because the operating system is not accepting the connection. The examples separately show failures caused by source or destination rules. These results distinguish policy allowance from a listening service. Microsoft Learn.

Applicability

Use this review for an authorized source-VM-to-destination investigation. Identify the protocol and destination port as well as both endpoint resource identities. Treat the source’s example port and probe counts as illustrations, not facts about the current incident.

DSE recommendation

DSE recommends reviewing each reported component before proposing another security exception. If the relevant rules already allow the path, ask the destination owner to inspect the intended service and guest configuration. Preserve the current policy and diagnostic results. Keep the correction scoped to the observed failure rather than expanding access simply because the overall test failed.

Verification

Repeat the same connection test after the approved correction and compare rule decisions with destination-port reachability. Confirm the intended application operation from the authorized source and check any required denial case. Record the source, destination, port and timestamps. A rule marked allowed should remain one item of evidence, not the final proof of a working service.

Official references

Microsoft Learn: Troubleshoot Outbound Connections.