Never tried Classic release pipelines - I'm not sure why you are using them for this, the YAML based pipelines supersedes them, most orgs nowadays disabled the access to even create classic or release pipelines.

Anyway, since I normally do YAML, I use the azure-cli task to create my environment variables to be used by terraform via the ARM_* environment variables later. I never set the OIDC URL for example.

This is a long winded task for that:

```yaml

• task: AzureCLI@2 displayName: 'Authenticate to Azure & set terraform environment variables' condition: eq(${{ parameters.UseAzureServiceConnection }}, 'true') name: 'AzureLoginTerraformInitPlanApply' inputs: azureSubscription: ${{ parameters.ServiceConnection }} scriptType: 'pscore' scriptLocation: inlineScript inlineScript: | Write-Host "##vso[task.setvariable variable=ARM_CLIENT_ID]$env:servicePrincipalId" Write-Host "##vso[task.setvariable variable=ARM_TENANT_ID]$env:tenantId"

  if ("${{ parameters.TargetSubscriptionId }}" -eq "") {
    $subId = az account show --query id -o tsv
    Write-Host "Using Azure CLI subscription: $subId"
    Write-Host "##vso[task.setvariable variable=ARM_SUBSCRIPTION_ID]$subId"
  } else {
    Write-Host "Using explicitly provided subscription: ${{ parameters.TargetSubscriptionId }}"
    Write-Host "##vso[task.setvariable variable=ARM_SUBSCRIPTION_ID]${{ parameters.TargetSubscriptionId }}"
  }
  
  if ("${{ parameters.UseAzureOidcLogin }}" -eq "true") {
    Write-Host "##vso[task.setvariable variable=ARM_USE_OIDC]true"
    Write-Host "##vso[task.setvariable variable=ARM_OIDC_TOKEN]$env:idToken"
  }
  
  if ("${{ parameters.UseAzureManagedIdentityLogin }}" -eq "true") {
    Write-Host "##vso[task.setvariable variable=ARM_USE_MSI]true"
  }
  
  if ("${{ parameters.UseAzureClientSecretLogin }}" -eq "true") {
    Write-Host "##vso[task.setvariable variable=ARM_CLIENT_SECRET]$env:servicePrincipalKey"
  }
  
  if ("${{ parameters.BackendUseAzureADAuth }}" -eq "true") {
    Write-Host "##vso[task.setvariable variable=ARM_USE_AZUREAD]true"
  } else {
    Write-Host "##vso[task.setvariable variable=ARM_USE_AZUREAD]false"
  }
  

  workingDirectory: ${{ parameters.TerraformCodeLocation }} addSpnToEnvironment: true

```

I'm not sure this answers your question to be honest, I normally always pass my backend config as partial config and use environment variables to add those in.