All Azure resources that are connected to a VNet, have an internet connectivity in the outgoing direction by default. The private IP address used by the resource is translated into a public IP address by the Azure infrastructure via a Source Network Address Translation (SNAT) operation.

In order to be able to communicate with Azure resources over the internet in the incoming direction, you must assign a public IP address for the resource to your VNet.