I don’t want to expose VMs to the entire internet - and neither should you. That is basically an invite to brute force attack the VM. Therefore, if I don’t use a VPN or Express Route connection to use private IPs, I use Network Security Groups (NSG) to control the traffic to VMs by allowing a single source IP.
In this post, I show how I do that with Terraform.