Start here. This is the direct spoken answer to practice first.
Why this question matters
Key Vault references let App Service resolve secrets through its managed identity and expose them through normal application configuration. Permissions, network access, slot behavior, refresh timing, and rotation still need deliberate ownership.
I would enable a managed identity on the App Service and grant that identity permission to read the needed secrets from Key Vault. Then I can put a Key Vault reference in an App Service setting, and the app reads it like a normal configuration value. The code does not need to store a client secret or password. I would use separate vaults or at least separate secret names per environment so staging cannot accidentally use production values.