Don’t worry, to make it work,he’ll only need to open the firewall to the Internet for dozens of MS subdomains and thousands of IP’s in ranges that can randomly change from day to day. Totally more an issue for systems which might have been segregated from the Internet before!

/s