pfSense in Azure (single NIC) IPSec NAT traffic

[grumple]

I need to setup a site-to-site VPN endpoint that will terminate at a location, and then be able to use that location's internet connection. The configuration I have today is

site a - LAN 192.168.10.0/24, WAN X.X.X.X
site b - LAN 192.168.20.0/24, WAN Y.Y.Y.Y

today site a routes all it's traffic to site b, and it get's NAT'd out on that side, this works.

Now the new setup

site c (Azure) - WAN Z.Z.Z.Z

I tried to setup the same in Azure, but when you setup the VM following the instructions, there's only a single NIC, and it won't NAT the traffic from site a even if I go in and create a NAT rule (it just sends it out untouched).

What I'm curious is if this is possible, or if I have to have a second interface (LAN) like I do currently at site b to make this work.