This documentation states that secret variables are
Not decrypted into environment variables. So scripts and programs run by your build steps are not
When using the YAML-syntax this can be achieved too:
steps: - script: | echo %MYSECRET% env: MySecret: $(Secret_Variable)