As per this Windows requests http://www.msftncsi.com/ncsi.txt or www.msftconnecttest.com/connecttest.txt and does a DNS lookup for dns.msftncsi.com, and then compares the result with the built-in values. Therefore you may need to whitelist these sites if you are blocking them via some firewall.
In case your network is ipv6 then the connectivity checking sites might be different.