An example: I run a vm that exposes mysubdomain.azure.com, can I turn on ssl at that level? A google search says "no" but I figure this is a place where someone might have a workaround.
Something you have to keep in mind are rate limits. Unless the (parent) domain owner has registered the domain in question as a public suffix[1], you, together with all other users who have subdomains under the parent domain, will be limited to 20 certificates per week.
Some domains, like for example the hostnames EC2 instances get that resolve to their public IP, have also been explicitly blacklisted because they are generally not assigned to anyone for longer periods of time, and it would be easy to mint certificates for a large number of those hostnames by just spawning tons of EC2 instances, which would make those certificates largely useless.
Finally, domain owners may decide to prevent issuance using a CAA DNS record, which are supported by Let's Encrypt.
It looks as though Azure itself also provides a CA [2], or at least resells one's services, for use with apps hosted on the platform. Depending on your needs, that may be a better alternative, though certainly it will also be more costly. It also appears [3] that the only route that service offers to satisfy the subdomain requirement is a wildcard cert, so there's that.
[1] https://community.letsencrypt.org/t/certificate-for-just-a-s...
[2] https://docs.microsoft.com/en-us/azure/app-service-web/web-s...
https://community.letsencrypt.org/t/can-i-use-lets-encrypt-i...
So you can turn on encryption at that level, and using Let's Encrypt, the private key for your cert would be unique for you. So private keys for azure.com won't be able to decrypt traffic for mydomain.azure.com.
But for ssl etc to work you would also have to get your vm setup so it "knows it's own (new) name" (alias.example.com).
[you could also use an A record with the ip, but I'm guessing guaranteeing sub-domain.azure.com points to the right ip is easier that updating the ip on updates etc to the vm]
That being said, I know they have a blacklist of certain domains. I've seen it once with amazonaws.com [3], and it's possible they have similar entries for azure.com, heroku, etc. They don't publicly release their blacklist.
[1] https://letsencrypt.org/how-it-works/
[2] https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.txt
[3] As in "my-loadbalancer-1234567890.us-west-2.elb.amazonaws.com"