Required on all software versions:
Heartbeat: TCP 443 - https://www.kbremote.net / 184.108.40.206 (currently)
API: TCP 443 - https://kbremote.azure-mobile.net / multiple ip addresses
Push (GCM/FCM): TCP 5228-5230, 443 - outbound - multiple ip addresses
Storage: TCP 443 - kbremote.table.core.windows.net kbremote.blob.core.windows.net
Note: If your organization has a firewall that restricts the traffic to or from the Internet, you need to configure it to allow connectivity with GCM in order for your GCM client apps to receive messages. The ports to open are: 5228, 5229, and 5230. GCM typically only uses 5228, but it sometimes uses 5229 and 5230. GCM doesn't provide specific IPs, so you should allow your firewall to accept outgoing connections to all IP addresses contained in the IP blocks listed in Google's ASN of 15169.
Customer support service by UserEcho