@NickSutton there isn’t exactly “fly documentation” for that, although I do have an example app that lets you deploy smokescreen proxy with HA.
In case your Azure resources support it, I would prefer creating a tiny machine on Azure and attaching that to your fly private network with fly wg. Static outbound IPs were specifically made for accessing services that don’t support a wireguard based setup.