How to allow specific ip address to access my webapp deployed in azure?

I have a deployed web app in azure but I want to allow only specific ip address ( or mac address if possible) to access the sites on the web app I deployed on azure. I've been searching for internet for step by step instructions but I really cannot find one. I saw several codes to paste to web.config but I do not know how to do it nor find that file.

What I understand is that I need to setup a network security group found under the settings on my web app but I cannot find it there. I can only see networking. Can someone please provide step by step instructions. TIA