Start here. This is the direct spoken answer to practice first.
Why this question matters
An App Service Key Vault reference resolves only when its syntax, secret version, managed identity, vault permissions, network path, refresh state, and slot ownership all agree. The platform reference status and vault access logs help locate the broken boundary.
I would check the reference syntax, whether the App Service has the expected managed identity enabled, and whether that identity has permission to read the secret. Then I would verify the secret exists, the vault permission model is correct, and network restrictions are not blocking App Service. I would also check whether the setting is sticky to the slot when staging and production need different values. If this broke after rotation, I would consider reference caching and trigger a safe refresh or restart when needed.