Removing all Roles from $Secret:Variable makes it unusable. And Get-PSUVariable on secrets does not show the value.

I m running into issues while accessing variables for a while now and I could finally pin down two reproducable issues.
I created 3 Secret variables:

1. SecTest = Secret without any role
2. SecTestRole = Secret with added role after creation
3. SecTestRoleRem = Secret with added role after creation, then removed the role again

SecTest should now be equivalent to SecTestRoleRem, but turns out, they are not.

Small script to inspect variables:

$names = @("SecTest","SecTestRole","SecTestRoleRem")


$names | ForEach-Object {

    Write-Information "Access via Secret:name Secret:$_ :"
    Write-Information (Get-ChildItem "Secret:$_")

    $PSUVariable = Get-PSUVariable -Name $_
    Write-Information ($PSUVariable | ConvertTo-Json)
}

Result of the Script:

Access via Secret:name Secret:SecTest :
S123456
{
  "Id": 23,
  "Name": "SecTest",
  "Value": null,
  "UserName": null,
  "Password": null,
  "Secret": true,
  "Vault": "Database",
  "Type": "System.String",
  "Description": null,
  "MissingSecret": false,
  "DisableRunAsSupport": false,
  "DeleteSecret": false,
  "ReadOnly": false,
  "Database": false,
  "Role": null,
  "Scope": 0,
  "Tags": [],
  "Tag": [],
  "Roles": null,
  "Force": false,
  "Module": null,
  "Required": false,
  "PasswordNotRequired": false,
  "SourceModule": null,
  "SourceModuleBase": null,
  "DisplayValue": ""
}
Access via Secret:name Secret:SecTestRole :
78293479
{
  "Id": 26,
  "Name": "SecTestRole",
  "Value": null,
  "UserName": null,
  "Password": null,
  "Secret": true,
  "Vault": "Database",
  "Type": "System.String",
  "Description": null,
  "MissingSecret": false,
  "DisableRunAsSupport": false,
  "DeleteSecret": false,
  "ReadOnly": false,
  "Database": false,
  "Role": [
    "Execute"
  ],
  "Scope": 0,
  "Tags": [],
  "Tag": [],
  "Roles": [
    "Execute"
  ],
  "Force": false,
  "Module": null,
  "Required": false,
  "PasswordNotRequired": false,
  "SourceModule": null,
  "SourceModuleBase": null,
  "DisplayValue": ""
}
Access via Secret:name Secret:SecTestRoleRem :
The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Cannot find path 'SecTestRoleRem' because it does not exist.

2 Issues:

1. None of the secret variables contain a "Value" or "DisplayValue", which I would expect them to.
2. SecTestRoleRem is no longer accessable via (Get-ChildItem "Secret:SecTestRoleRem") after the role removal.

To add further details, this script:

Write-Information "SecTest"
    Write-Information ($Secret:SecTest)
    $PSUVariable = Get-PSUVariable -Name "SecTest"
    Write-Information ($PSUVariable | ConvertTo-Json)
    Write-Information (Get-ChildItem "Secret:SecTest")

Write-Information "SecTestRoleRem"
    Write-Information ($Secret:SecTestRoleRem)
    $PSUVariable = Get-PSUVariable -Name "SecTestRoleRem"
    Write-Information ($PSUVariable | ConvertTo-Json)
    Write-Information (Get-ChildItem "Secret:SecTestRoleRem")

Should basically handle both secret variables the same, since they are configured the same, but will result in:

SecTest
S123456
{
  "Id": 23,
  "Name": "SecTest",
  "Value": null,
  "UserName": null,
  "Password": null,
  "Secret": true,
  "Vault": "Database",
  "Type": "System.String",
  "Description": null,
  "MissingSecret": false,
  "DisableRunAsSupport": false,
  "DeleteSecret": false,
  "ReadOnly": false,
  "Database": false,
  "Role": null,
  "Scope": 0,
  "Tags": [],
  "Tag": [],
  "Roles": null,
  "Force": false,
  "Module": null,
  "Required": false,
  "PasswordNotRequired": false,
  "SourceModule": null,
  "SourceModuleBase": null,
  "DisplayValue": ""
}
S123456

SecTestRoleRem
System.Management.Automation.InformationRecord
{
  "Id": 28,
  "Name": "SecTestRoleRem",
  "Value": null,
  "UserName": null,
  "Password": null,
  "Secret": true,
  "Vault": "Database",
  "Type": "System.String",
  "Description": null,
  "MissingSecret": false,
  "DisableRunAsSupport": false,
  "DeleteSecret": false,
  "ReadOnly": false,
  "Database": false,
  "Role": null,
  "Scope": 0,
  "Tags": [],
  "Tag": [],
  "Roles": null,
  "Force": false,
  "Module": null,
  "Required": false,
  "PasswordNotRequired": false,
  "SourceModule": null,
  "SourceModuleBase": null,
  "DisplayValue": ""
}
The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Cannot find path 'SecTestRoleRem' because it does not exist.

So removing roles from secret variables does break them.
Adding back a role, makes them usable again, until you remove the role again.

And Get-PSUVariable on secrets does not retrieve the value.

PSU Version2026.2.0