Azure Web Sites support IP restriction in the web config, as demonstrated by Stefan Schackow's MSDN Blog.
I then add the following to my web.config
While this works great for Azure, for local builds, you may encounter:
HTTP Error 500.19 - Internal Server Error
The requested page cannot be accessed because the related configuration data for the page is invalid.
|Config Error||This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".|
The culprit was the snippet at the bottom of my applciationHost.config
<location path="" overrideMode="Deny">
Commenting out the entire location tag resolves the issue.