Why Azure DevOps masks some non secret variables in the log output? - azure-devops

Question

I am logging several guids in the Azure DevOps output, please observe:
So, the *** (secret) *** is my output, because I know the particular field is a secret. However, the ClientId and TenantId are masked by Azure DevOps on its own accord and I do not understand how Azure DevOps decided it should be masked.
These are not build variables, just some Write-Host statements.
We are using on prem Azure DevOps Server 2019.
EDIT 1
Here is the Powershell script that runs:
function Initialize-AzureSqlDB(
[parameter(Mandatory)][ValidateScript({ Test-Path -LiteralPath $_ -PathType Container })]$DBScriptsSource,
[parameter(Mandatory)][string]$SqlServerName,
[Parameter(Mandatory)][string]$SqlServerResourceGroup,
[Parameter(Mandatory)][string]$SubscriptionId,
[Parameter(Mandatory)][string]$ClientId,
[Parameter(Mandatory)][string]$ClientSecret,
[Parameter(Mandatory)][string]$TenantId,
[string]$DBNamePrefix = "${env:UserName}_"
)
{
# Some code that does Write-Host for all the script parameters
...
The script is invoked from a YAML build template. The actual Service principal credentials are found in the ARM_... environment variables. Here is the YAML code:
- powershell: Initialize-AzureSqlDB -DBScriptsSource ${{ parameters.dbScriptLocation }} -DBNamePrefix ${{ parameters.dbNamePrefix }} -TenantId $env:ARM_TENANT_ID -SubscriptionId $env:ARM_SUBSCRIPTION_ID -ClientId $env:ARM_CLIENT_ID -ClientSecret $env:ARM_CLIENT_SECRET -SqlServerName $env:SqlServerName -SqlServerResourceGroup $env:SqlServerResourceGroup
displayName: Initializing Database(s).
condition: eq(variables['RunDBUpgrade'],true)
Now neither ClientId nor TenantId are defined as build variables. Their actual values do come from an exiting Service Connection Endpoint in Azure DevOps, but even there neither are secret.
So, it is unclear to me how Azure DevOps decides to mask them and not SubscriptionId, for instance. I, for my part, do not want either of them to be masked.
Can anyone explain how Azure DevOps decides what to mask here?
EDIT 2
So, I checked our extension and it contains the following code:
Write-Host "##vso[task.setvariable variable=ARM_SUBSCRIPTION_ID;]$($se.data.subscriptionId)"
Write-Host "##vso[task.setvariable variable=ARM_SUBSCRIPTION_NAME;]$($se.data.subscriptionName)"
Write-Host "##vso[task.setvariable variable=ARM_TENANT_ID;]$($se.auth.parameters.tenantid)"
Write-Host "##vso[task.setvariable variable=ARM_CLIENT_ID;isSecret=true]$($se.auth.parameters.serviceprincipalid)"
Write-Host "##vso[task.setvariable variable=ARM_CLIENT_SECRET;isSecret=true]$($se.auth.parameters.serviceprincipalkey)"
That can explain how ClientId gets masked, but not the TenantId. Now there is a possibility that the code in the master branch does not exactly match the one installed in server. I will make sure the task is redeployed and then we will know.