Ensure the Beacon can access the required CRL/OCSP URLs

The Beacon must reach Microsoft’s certificate validation services.
Verify outbound access by allowlisting the following URLs:

• http://www.microsoft.com/pki/mscorp/crl
• http://crl.microsoft.com/pki/crl/products
• http://www.microsoft.com/pkiops/
• http://ocsp.msocsp.com
• http://ocsp.globalsign.com

Once these URLs are accessible, Azure certificate validation succeeds and inventory gathering completes successfully.

NOTE: These URLs may change when Microsoft updates Azure certificates. Ensure your environment allows access to certificate authorities used by Azure.

Optional temporary workaround

If network changes cannot be made immediately, you can disable certificate revocation checks on the Beacon:

• Set the Beacon registry value:
  CheckCertificateRevocation = False

This bypasses CRL/OCSP checks but should only be used short-term until proper access is restored.

Beacon Registry Keys: https://docs.flexera.com/flexera/EN/ITAssets/FIB-Registry.htm