Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Auth incidents are high anxiety because they can be either an outage, a security issue, or a legitimate policy change gone wrong.
I would separate 401 from 403. A 401 spike points toward missing, expired, invalid, or unverifiable tokens. A 403 spike means users are authenticated but failing authorization. Then I would check release timing, identity-provider health, token validation errors, signing key rollover, clock skew, cookie or CORS changes, claim mapping, and recent role or tenant membership changes.