What ports are used for VSTS/TFS Build/Release Agent?

TFS 2017 ~ VSTS: 443
TFS 2015: 8080

Ref: https://learn.microsoft.com/en-us/vsts/pipelines/agents/agents?view=vsts

The TFS 2015 Build Agent i.e. Azure DevOps agent (formerly VSTS Agent) doesn't listen on any of the ports so no port has to be opened on the target machine.

It tries to connect to VSTS on HTTPS i.e port 443.

If you have a on prem installation, the port would be the one on which TFS is hosted which is generally 8080.

So you will need to allow outgoing connections to 443 or 8080 (default).