Maintaining secrets in Azure Key Vault so that we can limit individual access

I’m trying to understand the best practices around maintaining secrets in key vaults:

• Question 1: Should we give infrastructure access to Azure Key Vault and have the team member access to maintain the secrets?

• Question 2: Second options is to have a script that would read the values from ADO variable group and then the script would add/update them into the key vault.

I was trying to implement the second option so that we can have all the secrets managed from a single place and this is what happens.

The plan was to have those variables that are supposed to be in KeyVault start with the static string KeyVault_ and then read those using the az pipeline variable group show -- group-id $GROUP_ID but as expected the value is empty for secrets values.

How can I achieve a similar approach and update the key vault secrets from ADO secrets.

$variable_group.variables.GetEnumerator() | ForEach-Object { 
    if ($_.Key.StartsWith("KeyVault_")) {
        $SecretName = $_.Key -replace "KeyVault_", ""
        $SecretValue = $_.Value.value

        if ($SecretValue) {
            Write-Output "Creating secret for $SecretName."
            az keyvault secret set --vault-name $KeyVaultName --name $SecretName --value $SecretValue --output none
            Write-Output "Added secret '$SecretName' to Key Vault '$KeyVaultName'."
        } else {
            Write-Warning "No value found for variable '$($_.Key)'."
        }
    }
}

How can I get the value for $SecretValue assigned properly, I’ve tried $($_.Key) but with no luck!