I see that in Azure release pipelines, we can read secrets either by creating a key vault based variable group in library or by using the task "Azure Key vault" in pipeline. Both of them do the same thing i.e. reading the secret value from the key vault, with a difference that we can link variable group with multiple pipelines, and the "Azure Key vault" task would remain confined to one pipeline.
I want to understand what is the best practice while reading secrets from Azure key vault in release pipelines. Which of the two approaches is recommended here and why?