These are fantastic ways to secure your services. For a Web App, typically an Application Gateway or Front Door is best if you would like your Web App behind a WAF.
To secure a Virtual Machine, Azure Bastion is fantastic if you have multiple users connecting to the machine, along with auditing. If you only have one user logging in from a single IP, a NSG rule might be all that is needed. Remember to block SSH access from the Public IP of the VM if it has one.