Explanation Azure AD Connect needs to be able to connect to various Microsoft domains such as login.microsoftonline.com. Therefore, you need to modify the list of allowed outbound domains on the firewall. Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-ports