After a review by MS the data bag secret is set as a `securestring` in the parameters, but not a protected setting in the Azure Chef extension.