Firewall rules and encryption (KMM)

Managed Android devices
Outbound rules from the network the devices are on. Devices run Google's Android Device Policy for enrollment and policy, and the KMM client application for files, APK installs, screenshots and task reporting.
Address
Protocol
Port
Purpose
mdm.kuori.com
TCP
443
HTTPS REST calls from the KMM client (files, APK downloads, screenshots, token refresh, location reports)
mdm.kuori.com (path /ws)
TCP
443
WebSocket (WSS) from the KMM client for task delivery, heartbeat, connection quality and location requests
Google Android Enterprise endpoints
TCP
443, 5228–5230
Android Device Policy, Google Play, Firebase Cloud Messaging, device provisioning, OTA updates. See the Google document linked below.
DNS servers
UDP/TCP
53
Name resolution
NTP servers (time.google.com)
UDP
123
Time synchronization
Staging and development environments use 
mdm-stage.kuori.com and 
mdm-dev.kuori.com with the same ports.
Google's own network requirements for Android Enterprise devices:
Android Enterprise Network Requirements - Android Enterprise Help
Network whitelisting limitation (Android devices)
IP address–based whitelisting is not a viable approach for this solution.
The devices in scope run Android and rely on Google Play, Android Device Policy, Firebase Cloud Messaging and other Google-managed infrastructure. These services do not use fixed IP addresses; they operate on large, dynamic, globally distributed cloud networks, so the addresses change frequently and cannot be reliably predicted or restricted to a fixed range.
IP-based whitelisting would be unreliable and may cause service disruptions.
Essential functionality (policy delivery, app installs and updates, authentication) could fail if traffic is blocked due to changing IPs.
Maintaining an up-to-date allowlist of IP ranges is not practical or sustainable.
The Kuori hostnames above are stable and can be allowed by name. Google traffic requires general outbound internet access, and any restrictive filtering approach may lead to unintended loss of functionality.
External applications and network requirements
Applications distributed to the devices through KMM, whether from managed Google Play or as custom APKs, may have their own network requirements, including ports and endpoints. These should be reviewed and approved individually before deployment. Relying on IP-based whitelisting for these applications is not recommended, as many cloud services use dynamic addresses that frequently change. Allow only the outbound connections each application needs.