Start here. This is the direct spoken answer to practice first.
Why this question matters
Secret rotation changes both the value stored in Key Vault and the expectations of every consuming dependency and application. Refresh timing, version choice, slot configuration, and compatibility during the transition determine whether rotation is safe.
I would identify which secret rotated, which app setting references it, and which dependency started failing. Then I would check whether the App Service is using a versioned or versionless Key Vault reference, whether the new secret value is valid for the dependency, and whether App Service has refreshed the reference. If users are affected, I would decide between restoring the previous secret version, updating the dependent service, refreshing/restarting the app, or rolling back the release that assumed the new secret. I would verify recovery with the real dependency path, not just a healthy process.