Answer
Several supported patterns exist, all requiring a Service Request to IFS's Cloud Operations team rather than something a customer can configure entirely on their own: inbound Web Services access to FSM's integration endpoint can be IP-whitelisted (requiring TLS 1.2 with SNI support on the calling side); file-based integration goes through an IP-whitelisted Azure File Share (accessed via the AzCopy utility, with a Service Access Signature token) since Managed Cloud FSM can't connect directly to on-premise systems for file transfer; direct database access is similarly only available from IP-whitelisted locations; and outbound web-service calls from FSM to an on-premise-exposed service require the customer to whitelist FSM's own outbound IP range on their side. The FSM Integration Monitor itself (which watches the file share for new files) is configured within the FSM application by the project team, not set up by Cloud Operations.