Is there a better way to diagnose a hanging/slow update of a stack other than the -d flag on pulumi up? I have a simple stack (rsg,vnet, 3 subnets) and wanted to add a key vault but its stuck on "debug: Registering resource monitor end: t=pulumipulumiStack, name=tvp-sb, custom=False, remote=False" - since 9 minutes.

Have you tried this:

pulumi up --logtostderr -v9 --debug

That will give you more information. Which azure provider are you using? azure-nextgen?

Yup, I'm using azure next gen. I'll try it those flags, thanks.