I wish more flexible firewall settings like:

a) Allow inbound packets from Azure infractructure?
a-0) No.
a-1) Yes, all. (any)
a-2) Yes, but only from this and that VNET(s).

b) Allow inbound packets from the public Internet?
b-0) No.
b-1) Yes, all. (0.0.0.0/0)
b-2) Yes, but only from this and that IP range(s)