In the preview, some resources show normal behavior changing the tags like so:

~ azure-native:resources:ResourceGroup: (update)
    [id=/subscriptions/id/resourceGroups/appname-dev]
    [urn=urn:pulumi:dev::project.Infrastructure::azure-native:resources:ResourceGroup::appname-dev]
    [provider=urn:pulumi:dev::project.Infrastructure::pulumi:providers:azure-native::default_1_103_0::c4ad7357-cf22-4fea-8f17-f154b4f104bb]
  ~ tags: {
      ~ environment: "sandbox" => "dev"
    }

But others, like the webapp, are marked for deletion:

- azure-native:web:WebApp: (delete)
    [id=/subscriptions/id/resourceGroups/appname-dev/providers/Microsoft.Web/sites/appname-app-dev]
    [urn=urn:pulumi:dev::project.Infrastructure::azure-native:web:WebApp::webapp]
    [provider=urn:pulumi:dev::project.Infrastructure::pulumi:providers:azure-native::default_1_103_0::c4ad7357-cf22-4fea-8f17-f154b4f104bb]
    clientCertEnabled     : false
    enabled               : true
    httpsOnly             : true
    hyperV                : false
    identity              : {
        type                  : "UserAssigned"
        userAssignedIdentities: {
            /subscriptions/id/resourcegroups/appname-dev/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity-name: {}
        }
    }
    isXenon               : false
    kind                  : "app,linux"
    location              : "norwayeast"
    name                  : "appname-app-dev"
    reserved              : true
    resourceGroupName     : "appname-dev"
    scmSiteAlsoStopped    : false
    serverFarmId          : "/subscriptions/id/resourceGroups/app-name/providers/Microsoft.Web/serverfarms/service-plan-name"
    siteConfig            : {
        alwaysOn           : true
        appSettings        : [
            [0]: {
                name : "DATABASE_HOST"
                value: "localhost"
            }
        ]
        http20Enabled      : true
        linuxFxVersion     : "DOTNETCORE|6.0"
        localMySqlEnabled  : false
        minTlsVersion      : "1.2"
        netFrameworkVersion: "v4.6"
        numberOfWorkers    : 1
    }
    storageAccountRequired: false
    tags                  : {
        department : "IT"
        environment: "sandbox"
        system     : "website"
        team       : "web"
    }
    virtualNetworkSubnetId: "/subscriptions/id/resourceGroups/vnet-rg/providers/Microsoft.Network/virtualNetworks/vnet-name/subnets/subnet-name"

In total:

Resources:
    ~ 6 to update
    - 8 to delete
    14 changes. 12 unchanged

I'm pretty sure this was a mistake on my end since I have not been able to reproduce it since I posted this. We have a multi subscription environment and I suspect that I may have selected the wrong one in the Azure CLI. In short I think that my Pulumi stack and Azure subscription were not aligned.