While I'm close to posting my analyses of logging services, take a look at this. A VM has been attacked multiple times. Check in your Security Alerts panel from the Azure Security Center homepage. Just In Time VM access is enabled. If you're not using a VM, it doesn't have to be up until a service specifically asks for it. Watch the video for more.
I research and implement products + infrastructure for the Cloud, software, and other interesting things. My tailored Cloud Project Portfolio is at runtcpip.com