Has anyone had success configuring a local Windows firewall via Endpoint Security policies?

The main goal is to block absolutely all outbound traffic except our VPN endpoints and Microsoft services. After the VPN connection is established, the network profile switches to Domain, and the user receives a less restrictive set of rules.

I set the default outbound policy to block with local policies merge disabled and added an allow list based on all Microsoft FQDNs from official docs. I’ve had some success, but ran into a few issues:

1.Remote Help doesn’t work

2.Some Microsoft Store apps fail to install via Company Portal

This is more of a research phase for now, the task is tricky, and I’m not sure how to properly manage it in future, especially if Microsoft changes their endpoints.

Honestly, I really wish there were a simple policy like “allow Microsoft only”, but unfortunately its only dreams