I ran into the same problem with:
az vm extension set --name 'KeyVaultForLinux' --publisher 'Microsoft.Azure.KeyVault' ....
which has a '--settings' parameter, that expects a 'JSON' string.
After a bit of experimentation figured out that you have to escape every double quote '"' in the string with the backslash ''. So instead of:
'{"secretsManagementSettings": { "pollingIntervalInS": "3600", "certificateStoreName": "", "certificateStoreLocation": "/cert-directory", "observedCertificates": ["https://keyvault-name.vault.azure.net/secrets/certificate-name"] }}'
you need to provide:
'{\"secretsManagementSettings\": { \"pollingIntervalInS\": \"3600\", \"certificateStoreName\": \"\", \"certificateStoreLocation\": \"/cert-directory\", \"observedCertificates\": [\"https://keyvault-name.vault.azure.net/secrets/certificate-name\"] }}'