This message was deleted.

Locally Pulumi uses the Azure CLI to authenticate to Azure, so it should create your resources in the subscription where your are currently logged in. If your resources are already created, the state contains the identifiers of the resources so I guess whatever the subscription you are currently logged in, pulumi can sucessfuly do a refresh (if your azure cli account has the permissions on both the subscriptions). At least that's how I understand it

OK. I see. That makes sense. Possibly it's even at the stack level. Whenever a stack is created it is created for a particular subscription. So, even when creating new resources it uses the correct subscription.

I've ran into problems before where I managed to deploy half the resources in another subscription because the wrong one was selected via az cli. Now I have

pulumi.Config("azure-native").require("subscriptionId")

in all of my stacks so that it has to be excplitily defined.