How to deploy software builds from Azure DevOps to internal servers?
ADO agents only require external connectivity, so they talk to ADO, not vice versa. So you only need 443 outbound to a couple of ADO urls.
Reading: https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/agents?view=azure-devops#communication
https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-windows?view=azure-devops#im-running-a-firewall-and-my-code-is-in-azure-repos-what-urls-does-the-agent-need-to-communicate-with