As is typical, early in development the data portal is hosted locally on my dev machine. And the transition to hosting the data portal on a separate app server is generally straight forward. But with this WinRT app, the first I've done for the corporate environment, I ran into this problem:
Drilling down, the inner-most exception message was actually this:
"An attempt was made to access a socket in a way forbidden by its access permissions."
But everything was set up the same way my recent MVC projects have been set up. All permissions in IIS were correct.
The problem, it turns out, was not with IIS or the remote data portal. This article pointed to the necessity of declaring the right capabilities in the WinRT app's package manifest.