There are two main ways to do this. One is to restrict the allowable origins of web requests, which will need to be done by IP filtering. The other is to require extra authentication - specifically, TLS mutual authentication - on your server, using a TLS client certificate that only Cloudflare has; this will cause any web request from a host that doesn't have Cloudflare's TLS client cert to fail during the TLS handshake, before the request is sent. You can, if you want, use both approaches.
The firewall is the easiest and most logical way. You could also edit your web application to reject any incoming requests from outside of Cloudflare's IP range, but that's almost certainly both more work and less secure than just using the firewall.
Cloudflare has published an article explaining how to whitelist to them, and mentions either doing it using the web app config (such as a .htaccess file) or using a firewall (such as iptables). The IP address ranges used are documented here.
Cloudflare calls this feature "Authenticated Origin Pulls", and it might be easier than setting up and maintaining your IP range filter. The instructions are here, but they boil down to "turn on the feature, download the client cert, install it in your web application, and tell your web application to require mutual TLS using that client cert". Most web servers support mutual TLS, although the exact steps to configure it vary and I've never tried doing it from within Azure Web Apps.
Obviously, for this to be a meaningful security boundary, your app needs to not be usable over plain-text HTTP, since there's nowhere to get a TLS client certificate when not using TLS and therefore you can't check if the client has the right one. Ideally, you wouldn't even listen for non-HTTPS connections.
Also note that, because this is depending on the HTTPS server for security (much like application-level filtering depends on the web app server), it might be vulnerable to attacks that the firewall would block. (Of course, it is theoretically possible for the firewall to be vulnerable to attacks as well, but in general I trust firewall implementations more than I trust web server or TLS implementations.)