Is www.google.cn/generate_204 required in the firewall allowlist for Android Enterprise device management?

Hi,

We manage Android 14 devices (Grandstream GXV3480, Android Enterprise work-managed, enrolled in Workspace ONE UEM) behind a Palo Alto firewall with a URL allowlist.

In our firewall logs, one device repeatedly requests http://www.google.cn/generate_204 (and https://www.google.cn), about 76 times in 4 hours, and the firewall blocks every attempt. At the same time, the other connectivity probes pass: https://www.google.com/generate_204, connectivitycheck.gstatic.com, and play.googleapis.com/generate_204.

Google's Android Enterprise Network Requirements lists connectivitycheck.android.com, connectivitycheck.gstatic.com and www.google.com/generate_204 for the connectivity check. It does not mention google.cn anywhere.

Questions

1. Is www.google.cn (or *.google.cn) required to be reachable for Android Enterprise management, Google Play, Android Device Policy, or Google Play Services to work correctly?
2. If it is not required, can the block be left in place without affecting policy enforcement, app installation, or network validation (NET_CAPABILITY_VALIDATED)?
3. Why would a device in Spain use the google.cn probe? Is it chosen by the OEM ROM, by the SIM or MCC, or by a device setting? Is there a supported way to change it?
4. Can a blocked google.cn probe leave the network unvalidated, and could that delay background downloads started by DownloadManager (for example, an APK pushed by the EMM)?

Context

We have not confirmed that this block causes any problem. We are checking it as one possible factor in a failed system-app download on one device. Please tell us if the answer depends on the OEM ROM.