By default, the inbound firewall rule allowing SSH is enabled for a new Linux machine. If needed, you can disable SSH from the outside world for a SEM appliance. To see all default rules created per virtual machine, see the Default security rules topic on the Microsoft website.
Configure firewall rules based on your specific needs. Review the SEM port and firewall requirements here.
The following example shows security rules for a SEM Azure deployment: