`##vso[task.setvariable]` does not work as expected if `issecret=true`

According to https://github.com/Microsoft/vsts-tasks/blob/master/docs/authoring/commands.md, I should be able to call Write-Host ("##vso[task.setvariable variable=testvar;issecret=true;]testvalue") in a Powershell build step and then call Write-Host "testvar: $Env:testvar" in a subsequent Powershell build step, but it doesn’t seem like the variable was saved because the output is just testvar: when I was expecting testvar: ********.

If I remove issecret=true;, it works as expected, but the value is not masked in the output.

Thank you.

[ericsciple]

You need to use macro syntax in the input text boxes for secrets. Here is an example:

steps:
- powershell: |
    write-host '##vso[task.setvariable variable=myVariable]asdf'
    write-host '##vso[task.setvariable variable=mySecret;issecret=true]qwerty'
- powershell: |
    write-host "this works: $(myVariable)"
    write-host "this works: $env:MYVARIABLE"
    write-host "this works: $(mySecret)"
    write-host "this does not work: $env:MYSECRET"

[jtourlamain]

@jnoyola I use a powershell script that generates random characters (based on https://devblogs.microsoft.com/scripting/generate-random-letters-with-powershell/) At the end of the script I inject it into the pipeline via

Write-Host ("##vso[task.setvariable variable=$outputVariableName;issecret=true;]$randomPass")

The issecret means it doesn’t show up in logs. So, I don’t actually convert the random string to a secure string via the ConvertTo-SecureString but thanks to the issecret flag it stays hidden from logging.

In your ARM template, define your parameter as securestring like I mentioned above.