In Microsoft Azure one can store secret values like passwords in Azure Key Vault, but also as encrypted variables in Azure Automation (these ones are stored in an Azure-managed Key Vault behind the scenes).
From a solution design perspective, if Azure Automation is used to trigger all the solution code executions, is there a good reason to use a Key Vault at all? Why not use the Automation Account variable storage to hold, manage, and retrieve my passwords from for insertion into code at execution time.
Or is it rather best practice to always use the Key Vault to store resource passwords (e.g. for deployment and access of VM, SQL Server)? If so, what is the rationale behind it?