Not sure what you mena by off premises but automox only needs an agent installed on the endpoint. It then communicates with its own cloud (hosted in AWS) via tcp80 and tcp443 both of which are usually open as it is normal for web traffic to use those ports. You then access the cloud via a browser only to configure and monitor all the automox agents.

Thanks, that sounds about right, so the cloud server doesn’t need to be on a vpn of any kind?

I take it you have to enter your domain admin credentials on the server to give it rights to make changes on the endpoints?

No credentials required, you install an agent that has permission to perform changes on the endpoint. That agent can be baked into your golden image or deployed with a different deployment tool. The agent then looks at your windows update catalog and sends that data back up to a cloud based console. Then you as the admin can make decisions on those patches and the agent will carry out your wishes. Additionally, anything you write in Powershell/Bash can be pushed down to the agent in the form of worklets (if you pay for the 5$ plan instead of the 3$).

TL;DR: Normal web traffic ports need to be opened, nothing else firewall side. Agent needs to be installed on each endpoint.

https://support.automox.com/help/agent-firewall-whitelisting-rules

Right, that sounds perfect tbh, thanks very much!