Per https://github.com/projectkudu/kudu/wiki/Azure-Web-App-sandbox
Regardless of address, applications cannot connect to anywhere using ports 445, 137, 138, and 139. In other words, even if connecting to a non-private IP address or the address of a virtual network, connections to ports 445, 137, 138, and 139 are not permitted.
I suspect the reason is because, on Windows, file system layer negotiated SMB sockets cannot discriminate between processes, so when we're using a shared environment, it purposefully blocks SMB so that one customer cannot guess and use SMB connections belonging to another customer or to Microsoft.
I don't have a workaround for this (yet?), but I figured I should log it as an issue for awareness.