Prevent machines to go to the internet

Hello I'm trying to prevent the machines on certain subnet to go to web (except ports 80 and 443).

I created NSG and assigned to a subnet.

This is how the rules looks like :

Name                 Priority  Action   Source Address  Source Port   Destination      Destination    Protocol
                                        Prefix          Range         Address Prefix   Port Range
----                 --------  ------   --------------- ------------- ---------------- -------------- --------
Allow Internet HTTP  200       Allow    10.X.X.0/24   80            INTERNET         80             TCP
Allow Internet HTTPS 201       Allow    10.X.X.0/24   443           INTERNET         443            TCP
Default Block Rule   202       Deny     10.X.X.0/24   *             INTERNET         *              TCP
ALLOW VNET OUTBOUND  65000     Allow    VIRTUAL_NETWORK *             VIRTUAL_NETWORK  *              *
ALLOW INTERNET       65001     Allow    *               *             INTERNET         *              *
OUTBOUND
DENY ALL OUTBOUND    65500     Deny     *               *             *                *              *

Unfortunately it's not working

Any ideas ?

Thanks