When creating a VM with the new Resource Manager, I can see that the default Network Security Group restricts every incoming access to all ports (except the administration port, SSH/RDP), which makes sense.
But how about if I install some software on the VM which requests UPnP to its gateway? Would the NetworkSecurityGroup allow its incoming traffic by default? Do I need to install a firewall in the guest to prevent this?