Wow, LOL, same thing happened to me and when I learned that someone had already reported it and nothing was done to alert others who also follow best practices with common ports, I was shocked. Would have saved me a lot of wasted time if this displayed an extremely simple alert. Oh well, thanks @girish.
I have never used Cloudron so was just testing it out. But seems now I have 2 firewalls, Azure and the built-in OS ufw/iptables seems to have been turned on (hence being locked out of SSH). Not sure how I feel about that. Hoping that can be disabled as I prefer to use my existing VNet security group.
But will play with it and see how I like it.