This documentation states that secret variables are
Not decrypted into environment variables. So scripts and programs run by your build steps are not
Use a Command Line task, like this:
target_environment_variable now contains the value of secret_variable.
Add a subsequent Command Line task that writes all environment variables to a disk file, like this: (note: in the Arguments text box, write to a folder that both you and build agent can access):
Queue the build definition, then view the file containing the environment variables: