Start here. This is the direct spoken answer to practice first.
Why this question matters
App Service configuration sits outside the deployed artifact and can change application behavior or restart the process. Code defaults, environment values, secret references, slot-specific settings, and operational ownership need clear boundaries.
I would keep environment-specific values in App Service app settings or connection strings, not hard-coded in the deployed artifact. ASP.NET Core reads those values through normal configuration providers, so production settings can override appsettings files. I would separate dev, staging, and production values and treat changes as operational events because changing App Service settings can restart the app. Secrets either use Key Vault references or another managed secret flow rather than plain source-controlled files.