To have a VM in Azure which is not visible in the internet (or) to create a VM without a public IP or a domain name

hi,

I have a VM running in a VNet in Azure, and I ONLY want to access it via Point - Site VPN. This VM should be completely invisible to the internet. i tried to bring down the cloud service, but that turns off the VM as well. so is there any other better way to do this?