ENSFW has a built-in rule that allows traffic from the masvc.exe process, even if a firewall rule is present to block it. But, the process must be signed with a specific certificate so that ENSFW can't block agent-to-server communications.

The built-in rule does not account for the certificate change. So, it is possible for ENS to block agent-to-server communication when you use a non-default firewall rule set.

Similarly, DLP has a self-protect feature called access protection which relies on the certificate to trust the process trying to communicate with DLP. Because DLP does not trust the certificate that the MA services are signed with, MA can't hand off the policy update to DLP to enforce.