[notreallyserio]

Google offers a way to access Google services from your VM 1918 IPs so you don't need to use NAT. I wonder if Azure would consider doing the same.

[jaywalk]

If you do the blocking in Azure via a Network Security Group, it's simple. You can allow outbound traffic to Azure services and deny anything else.

[ThePowerOfFuet]

Until an Azure service is misused for exfil.

[infogulch]

Not all services support it yet, but private endpoints are a great solution to this issue in azure.