Can't inject a non-certificate secret into vm with az vm create

**Describe the bug**
Hi, I'm trying to use cloud-init to automate the configuration and registration of a Linux build agent self-hosted in an ASE, since the agent will be redeployed regularly. To automate the registration, I need to inject an Azure DevOps personal access token into cloud-init. I added the token to a key vault and tried using [this tutorial](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/tutorial-automate-vm-deployment) to inject the token, but received the following error:
```
Deployment failed. Correlation ID: 6a440bdb-b5fb-48df-9e0b-fa3bc03d8fe4. {
"status": "Failed",
"error": {
"code": "ResourceDeploymentFailure",
"message": "The resource operation completed with terminal provisioning state 'Failed'.",
"details": [
{
"code": "CertificateImproperlyFormatted",
"message": "The data retrieved from *** is not deserializable into JSON."
}
]
}
}
```

**To Reproduce**
```
secret=$(az keyvault secret list-versions --subscription "{subscription}" --vault-name {vault name} --name {secret name} --query "[?attributes.enabled].id" --output tsv)

vm_secret=$(az vm secret format --subscription "{subscription}" -g "{resource group}" -s "$secret" --keyvault {vault name})

az vm create \
--name {vm name} \
--resource-group {resource group name} \
--image Canonical:UbuntuServer:18.04-LTS:latest \
--location eastus2 \
--size Standard_B1ms \
--admin-username {admin username} \
--vnet-name {vnet name} \
--subnet {subnet name} \
--custom-data cloud-init.txt \
--nsg {nsg name} \
--ssh-key-values {public ssh} \
--secrets "$vm_secret" \
--tags environment=test
```
**Expected behavior**
I would be allowed to inject actual secrets with az vm create --secrets, rather than only certificates.

If this isn't possible, I would like to be guided on the best practice for injecting secrets into cloud-init.

**Environment summary**
CLI version 2.0.70 , bash shell