Azure Resource Managed VMs now use the concept of Network adapters, Virtual Networks and Security Groups to manage ingress, egress from a machine.
A virtual machine has a network adapter attached, the adapter is placed within a subnet within a virtual network. A security group can then be placed against the subnet and / or the network adapter.
The network adapter can optionally have a publically accessible address bound to it. Either dynamically or statically bound (i.e. if you take a fixed address, you will be charged for it for when the machine isn't running)
I'm not entirely sure its possible to create a security group via the portal (at least I couldn't find any option for it when I just (albeit briefly) looked.
However you can use New-AzureNetworkSecurityGroup to create a security group and then attach it to your Nic through the portal and also configure the security policy. Which you get to via -
Virtual machines -> VNMame-> Settings -> Network interfaces -> NicName -> Choose network security group
It is a little more complicated than the previous method, but once you're used to it it is a lot more flexible.
Edited to add
Depending on your config, you might need to a public IP address attaching also - use New-AzurePublicIpAddress