Outbound ACLs to Reduce Exfiltration

Is there a way to create an Outbound ACL for a VM on Azure?  I could, of course, use a Windows Firewall to do this at the OS level, or ip tables on Linux.  However, I would like to do this within Azure networking itself.  That way, if the VM is badly compromised by an attacker, Azure networking could still prevent the VM from connecting to the Internet and exfiltrating sensitive data.  Currently, Azure has per VM ACLs for inbound traffic, but apparently none for outbound traffic.