ok, so I'm injecting a short-lived VPN enrollment token via cloud-init custom data (it took twenty minutes to implement instead of three hours). the problem is, if i change any policies around that token (eg, lifespan), it updates the custom data, and pulumi tries to change custom data on existing VMs. Azure just rejects this. Which is reasonable, it's not a sensible operation. Can I get pulumi to not update this property? I honestly don't care after initial resource creation.

ignoreChanges allows you to do exactly that.

thanks!