How to use secrets in Azure DevOps Powershell script task

Question

I have a secret in a Azure keyvault which basically stores 1 command az login --service-principal -u ...

I am trying to call this secret in a simple Powershell Task but when I run the pipeline every time it appears as masked with output ***. It doesn't need to be shown it just needs to do what it is meant to

Azure DevOps pipeline is classic ( cannot be YAML for now)

Powershell Task is file path one (cannot be inline as script passes 20000 chars)

Answer 1

I have a secret in a Azure keyvault which basically stores 1 command az login --service-principal -u ...

Azure Key Vault should be used to store sensitive information, not logic of any kind. Consider creating secrets for the user name, password and tenant ID instead of storing the whole az login... command.

Another alternative would be to use an Azure service connection for the service principal.

I am trying to call this secret in a simple Powershell Task but when I run the pipeline every time it appears as masked with output ***

Secret variables are encrypted variables that you can use in pipelines without exposing their value, i.e. Azure Pipelines makes an effort to mask secrets when emitting data to pipeline logs.

Please note that the recommended ways to set secret variables are in the UI, in a variable group, and in a variable group from Azure Key Vault. You can also set secret variables in a script with a logging command but this isn't recommended since anyone who can access your pipeline can also see the secret.

See Set secret variables for more details.