A rotated Key Vault secret is correct, but App Service still uses the previous value
A fictional application uses a Key Vault reference without a version in its URI. A new secret version has been created and is enabled. Requests from an authorized diagnostic client use the new value successfully, but the application behaves as if it has the old credential. Is this necessarily a permissions failure, and how should refresh behavior be checked?