I know this is a bit of a niche topic. What I'm trying to do is to allow my KVM guest to have a dedicated NIC (eth1) to use for internet, while blocking internet via NSG (eth0) for the KVM host.
In KVM there's an option to use Macvtap private mode to allow the guest to fully use the eth1 on the host. Works fine on my baremetal but doesn't on Azure. I see the macvtap module is loaded on Azure VM so why wouldn't this work?
How I did this on Azure:
I created two NICS with different IPs on the same vnet and subnet. Both NICs have a public IP associated. Connect both nics to KVM Host. On the KVM host I don't configure any network settings for the second NIC. I add second NIC as macvtap to the guest and configure correct IP on the guest.