You can use a Universal Forwarder on the VM. But, you can also use the Splunk Add-on for Microsoft Cloud Services. This option does not require a UF installed on the VM. Instead, you configure which logs you want to collect in the Azure Portal and a storage account to write the logs. Then, use the Splunk Add-on for Microsoft Cloud Services to pick up these logs from the storage account and ingest them into Splunk.