A full node connects outbound only, to wss://mesh.agentmesh.ai (WebSocket over 443, the default) or raw NATS on TCP 4222 if you prefer the native protocol. Nothing listens. There is no inbound rule, no load balancer, no public address and nothing for a scanner to find; a subnet with no public IP and a NAT gateway for the way out is the intended shape, and it is the same pattern as the build agents your network team already lets out to GitHub.

Idle timeouts are the thing to get right, because everything in the path has one and the default is four minutes. NAT Gateway will go to 120 if you ask, Azure Firewall stops at fifteen and only by support request, and a load balancer drops an idle flow silently unless you turn on TCP reset, which is the worst version: the agent believes it is connected and is not. Keepalives are the answer Microsoft points at, and a mesh connection is not a silent one: the protocol exchanges periodic pings in both directions, so it does not normally sit idle long enough to trip a four-minute timer. It is still the first thing to check if an agent goes quiet at suspiciously round intervals.

If egress runs through Azure Firewall, use a network rule with the destination as an FQDN rather than an application rule. Network rules are evaluated first and an application rule is only reached when no network rule matched, so an L4 allow is both simpler and the one that actually governs a long-lived socket. It also keeps the connection out of the Premium tier's TLS inspection, which is worth avoiding here on its own terms.

If your subscriptions are governed by a network security perimeter, this is a long-lived connection from inside that boundary to a third-party service, which is a documented decision rather than a config tweak. Decision 06 lists what crosses the wire so the review reads facts rather than guesses.