A rotated Key Vault secret is correct, but App Service still uses the previous value

First verify that the reference is actually versionless and points to the expected vault and secret. App Service caches reference values, and Microsoft’s documentation describes a normal refresh period of about 24 hours. A successful direct secret read does not demonstrate what the application’s cached setting contains.

After checking identity and connectivity, use the documented authenticated reference-refresh operation or the appropriate configuration refresh path. Coordinate changes that may restart the application. Validate with a successful dependent operation rather than writing the secret into logs. In this example, the diagnosis is a reference-refresh delay, with application-level credential caching checked separately.