[jaywalk]

If you do the blocking in Azure via a Network Security Group, it's simple. You can allow outbound traffic to Azure services and deny anything else.

[ThePowerOfFuet]

Until an Azure service is misused for exfil.