The Aspire Microsoft Search publisher requires internet access to publish to a Microsoft Search index
Register your AAD app (as multi-tenant or ask admins to register it as single tenant) and add the permission ExternalItem.ReadWrite.All. This permission requires global admin (or) application admin to consent to the use of app within their tenant. Once consented you would be able to create connections and ingest content.
For detailed documentation on application registration, refer: register an app.
For details on tenancy & creating multi-tenant apps, refer: Tenancy in Azure Active Directory.
For details on pre-authorization flow & different ways to consent, refer: Consent to an application.
The Microsoft Search publisher run on either Windows or Linux.