Rule of thumb:

Secrets → Key Vault

Configs → App Configuration

Use both for secure + flexible configuration management.

Azure Key Vault