Unable to ssh into Azure VM -- connection timed out

I am trying to create a VM with the Azure CLI and ssh into it from Azure Cloud Shell. I have followed the official guide (https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-cli) by running these commands:

$ az group create --name myGroupName --location westus2
$ az vm create --resource-group myGroupName --name myVmName --image UbuntuLTS --admin-username azureuser --generate-ssh-keys

However, when try to connect via ssh with the public IP address reported by the second command above, the connection times out:

$ ssh -vvv azureuser@publicIpAddress
OpenSSH_7.2p2 Ubuntu-4ubuntu2.10, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "publicIpAddress" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to publicIpAddress [publicIpAddress] port 22.
debug1: connect to address publicIpAddress port 22: Connection timed out
ssh: connect to host publicIpAddress  port 22: Connection timed out

Any suggestions on what I am doing wrong?

In addition, I have tried running these commands in Powershell on my local machine. I have found that after I create a new resource group, and then launch a VM, I am able to ssh into the VM using Powershell. But when I disconnect from the VM and then try to ssh back into it, I am unable to re-connect since it results in the timeout error. If I try to create a new VM under the same resource group, I am unable to ssh into it at all. If instead, I create a new resource group and a new VM, I can ssh into it the first time, but not on subsequent tries.

As far as I know, you could check if there is an NSG automatically associated with your VM NIC or subnet by Azure policy or others in your current subscription after you create the Azure VM. Probably, it adds some inbound port rules in the NSG to blocking the network connection. If you want to SSH into your Azure VM. it must have a higher priority inbound rule to allow access port 22 as below. You also could add your client public IP as the source in the rule to narrow the limitation.