This script can be use to update app config in azure pipeline using octopus variable set

AppConfigUpdator.ps1

Param(
    [Parameter(Mandatory=$true)]
    [string] $octopusUrl,
    [Parameter(Mandatory=$true)]
    [string] $octopusAPIKey,
    [Parameter(Mandatory=$true)]
    [string] $environmentName = 'DEV',
    [Parameter(Mandatory=$true)]
    [string] $octopusSpaceName = 'Default',
    [Parameter(Mandatory=$true)]
    [string] $octopusProjectName,
    [Parameter(Mandatory=$true)]
    [string] $appConfigFilePath,
    [Parameter(Mandatory=$false)]
    [string] $azureAccoutUser,
    [Parameter(Mandatory=$false)]
    [string] $azureAccoutUserPwd,
    [Parameter(Mandatory=$false)]
    [string] $azureSubscriptionId
)

$variableName=""
$variableValue=""
$keyVaultName=""
$header = @{ "X-Octopus-ApiKey" = $octopusAPIKey }

$ErrorActionPreference = "Stop";

try
{

    $notLoggedOntoAz = $true;

    Write-Host ("Get content of " + $appConfigFilePath +"...")
    # Read the App.config content
    $doc = ((Get-Content -path $appConfigFilePath) -replace "`0", "") -as [xml];

    # Find the space
    $spaceList = Invoke-RestMethod "$OctopusUrl/api/spaces?Name=$spaceName" -Headers $header
    $spaceFilter = @($spaceList.Items | Where {$_.Name -eq $octopusSpaceName})
    $spaceId = $spaceFilter[0].Id
    Write-Host "The spaceId for Space Name $octopusSpaceName is $spaceId"

    # Find the environment
    $environmentList = Invoke-RestMethod "$OctopusUrl/api/$spaceId/environments?skip=0&take=1000&name=$environmentName" -Headers $header
    $environmentFilter = @($environmentList.Items | Where {$_.Name -eq $environmentName})
    $environmentId = $environmentFilter[0].Id
    Write-Host "The environmentId for Environment Name $environmentName in space $octopusSpaceName is $environmentId"

    # Find the project
    $projects = Invoke-RestMethod  -UseBasicParsing "$OctopusUrl/api/$spaceId/projects/all?skip=0&take=1000&name=$projectName&" -Headers $header
    $projectFilter = @($projects | Where {$_.Name -eq $octopusProjectName})
    $projectId = $projectFilter[0].Id
    Write-Host "The projectId for Project Name $octopusProjectName in space $octopusSpaceName is $projectId"

    # Get the evaluated variables for the provided scope
    $evaluatedVariables = (Invoke-RestMethod -UseBasicParsing "$OctopusURL/api/$spaceId/variables/preview?project=$projectId&environment=$environmentId" -Headers $header).Variables

    # Loop each of variable from octopus - begin
    foreach($octopusVariable in $evaluatedVariables)
    {
      #check if the app.config has a key by name of the variable
       $variableName=$octopusVariable.Name;

       Write-Host ("Processing variable " + $variableName +"...")

       $appConfigEntry = $doc.configuration.appSettings.add | where {$_.Key -eq $variableName}

            #if app config has the key with the variable name -begin
            if(-not ([string]::IsNullOrEmpty($appConfigEntry)))
            {
                Write-Host ("App Config entry found for variable " + $variableName)
                
                # Assign octopus variable value to a $variableValue
                $variableValue=$octopusVariable.Value;

                #Check if the variable name starts with @Microsoft.KeyVault - begin
                if($variableValue.startswith('@Microsoft.KeyVault'))
                {
                    Write-Host ("Variable need to be obtained from KV")

                    if ($notLoggedOntoAz)
                    {
                        Write-Host ("Log on to Azure")

                        $notLoggedOntoAz = $false;

                        az login --username $azureAccoutUser --password $azureAccoutUserPwd
                        az account set --subscription $azureSubscriptionId

                        Write-Host ("Log on to Azure sucess.")
                    }

                    $splitSections=$variableValue.split(";");
                    $splitSecretName=$splitSections[1].split("=");
                    $secretName=$splitSecretName[1];
                    $keyVaultName = $splitSections[0].Replace("@Microsoft.KeyVault(VaultName=","");
                    $secretVersion=$splitSections[2].Replace("SecretVersion=","").Replace(")","");

                    #read the variable value from KV and assign to $variableValue
                    $variableValue = (az keyvault secret show -n $secretName --vault-name $keyVaultName --version $secretVersion | ConvertFrom-Json).value

                    Write-Host ("Obtained value from KV for varaible " + $variableName)
                }
                #Check if the variable name starts with @Microsoft.KeyVault - end

                #Update app .config entry with $variableValue
                $appConfigEntry.value = $variableValue
                Write-Host ("Updated app config entry.")
            }#if app config has the key with the variable name -end
        
        Write-Host ("Processed variable " + $variableName +".")
      }# Loop each of variable from octopus - end
  
    Write-Host ("Saving config file " + $appConfigFilePath)
    #save the app.config
    $doc.Save($appConfigFilePath) 
    Write-Host ("Done.")
}
catch
{
    Write-Host $Error[0] -ForegroundColor Red
    exit 1
}