title: Unable to read VSTS Online release variables
body: <p>I'm working with VSTS environment variables and stuck with variables of a secret type.<br>
  I'm using POSH script (file) to generate a variable (in fact, to obtain the value from Azure Key Vault and the set this value to the variable):  </p>
  
  <p><strong><em># Add as a script parameter during the release step</em></strong></p>
  
  <pre><code>-ResourceGroupNameArg "$(ResourceGroupName)" -KeyVaultNameArg "$(KeyVaultName)" -KeyVaultSecretNameArg "$(KeyVaultSecretName)"
  </code></pre>
  
  <p><strong><em># The script itself</em></strong>  </p>
  
  <pre><code>Param(
     [string]$ResourceGroupNameArg,
     [string]$KeyVaultNameArg,
     [string]$KeyVaultSecretNameArg
  )
  &lt;...&gt;
  $secret = Get-AzureKeyVaultSecret -VaultName $KeyVaultNameArg -Name $KeyVaultSecretNameArg 
  $secretValue = $secret.SecretValueText
  Write-Host "##vso[task.setvariable variable=SQLAdministratorPassword;issecret=true]$secretValue"
  </code></pre>
  
  <p><strong><em>Here I can pass to the script different KeyVault names (according to my needs) - by substituting the $KeyVaultNameArg and $KeyVaultSecretNameArg variables.</em></strong>  </p>
  
  <p>For any other variables configured using <code>##vso[task.setvariable variable=</code> I am able to retrieve them using the construction  <code>$env:DatabaseName</code> (for example in another POSH script) or <code>$(DatabaseName)</code> in agent phase step (using Hosted 2017 agent).  </p>
  
  <p>However, for the <code>issecret=true</code> variable or even for a manually created variable I'm unable to retrieve its values during the release deployment process.</p>
  
  <p><img src="https://i.stack.imgur.com/iClpg.png" alt="variables">
  <img src="https://i.stack.imgur.com/DhNPm.png" alt="script">
  <img src="https://i.stack.imgur.com/8xcVn.png" alt="release-error">
  <img src="https://i.stack.imgur.com/Ye0KO.png" alt="step-release"></p>
  
  <p>According to <a href="https://docs.microsoft.com/en-us/vsts/build-release/concepts/definitions/release/variables?view=vsts&amp;tabs=powershell#custom-variables" rel="nofollow noreferrer">this</a> article, </p>
  
  <blockquote>
    <p>The values of hidden (secret) variables are stored securely on the
    server and cannot be viewed by users after they are saved. During a
    deployment, the Release Management service decrypts these values when
    referenced by the tasks and passes them to the agent over a secure
    HTTPS channel.</p>
  </blockquote>
  
  <p>So IMO the variables should be accessible for the script (or even agent phase step) despite they are secret.</p>