title: Dynamic access to Key Vault secret variables in Azure DevOps
body: <p>I have a Azure Key Vault with different keys (e.g. Key1, Key2, Key3). In some setting, which is dynamically read in one pipeline task, I have value which says which key to use (lets KeyName variable be 'Key2'). How can I read the secret value of the Key2 in the pipeline?</p>
  <p>I have tried different combinations and none is working for me.</p>
  <p><strong>Test pipeline no. 1 - using the group variable connected to the Key Vault (to make it easier, the KeyName is static here, but in reality, it is set through powershell script during the pipeline):</strong></p>
  <pre><code>jobs:
  - job: JobA
    variables:
    - group: KeyVaultGroup #Key vault have secret values &quot;Key1,Key2,Key3...&quot;
    - name: KeyName
      value: Key2
    - name: MyValue
      value: $[ variables[variables.KeyName] ]
    steps:
    - powershell: |
        Write-Host &quot;Var1 $($env:VARENV1)&quot;
        Write-Host &quot;Var2 $($env:VARENV2)&quot;
      env:
        VarEnv1: $(MyValue)
        VarEnv2: $($(KeyName))
  </code></pre>
  <p>Result is:</p>
  <pre><code>Var1 
  Var2 $(Key2)
  </code></pre>
  <p>MyValue is not working, because the variable is evaluated before the key vault variables are loaded. And when the KeyName is set during the pipeline, it will not work because that too (but this could be solved by using separate job and using output variables to set the KeyName - like in test example no. 2).
  Expression $($(KeyName)) is not working, because it will not recursively expand the variable (bug?).</p>
  <p>Same problem is when the AzureKeyVault task is used to read the Key Vault values, because it is triggered too late.</p>
  <p><strong>Test no. 2 - two separate jobs:</strong>
  I have used 2 jobs - one to read the key vault and Key name (Job A) and second for the rest (Job B). Problem is, that there is no way how to access the key vault secret values loaded on job A from the job B. I can use only output variables from Job A in the Job B through the dependencies.JobA... but the task AzureKeyVault is not exporting the values as output variables. To do so I will need to use e.g. Powershell task, but in this case, I will need to map the secret values as environment variables into the powershell task, but it means I will loose the dynamic part I need, because it will be statically mapped ( I need to be able to add/remove the values in the key vault without need to change the pipeline). This is no go or I do not know the way how to access the secret variables between jobs without using output variables.</p>
  <p><strong>Question:</strong>
  How to read the secure value from key &quot;Key2&quot; when the Key2 is saved as variable value KeyName and is loaded during the pipeline?</p>