I would really like to use Azure Functions for an upcoming project, but is there a way to create a whitelist of IPs like in ipSecurity in Web.Config?
They are using
Unfortunately, as you don't have control over a web.config this isn't doable that way.
You could do the ip validation within the function itself or add a solution like API Management to block traffic.
If you're willing to run on dedicated (not consumption plan), you can deploy the functions runtime as a site extension with a modified web.config with the ip whitelist you need: https://github.com/Azure/azure-webjobs-sdk-script/wiki/Deploying-the-Functions-runtime-as-a-private-site-extension