By default, the inbound firewall rule allowing SSH is enabled for a new Linux machine. If needed, you can disable SSH from the outside world for a SEM appliance. To see all default rules created per virtual machine, see Default security rules (© Microsoft 2020, available at docs.microsoft.com, retrieved October 5, 2020).
Configure firewall rules based on your specific needs. Review the SEM port and firewall requirements here.
The following example shows security rules for a SEM Azure deployment: