In the "Team Starter" plan, does the "Azure Service Principal" count towards the 3 users included in the plan? Or is it three pulumi user accounts that get access to the organisation?

The service principal you use to do deployments does not need to be a separate user. But many teams choose to use a bot account in their CI/CD setup to do deployments (instead of using a real user’s api tokens). The latter would be a separate user account in Pulumi.

@white-balloon-205 thanks, I think I understand what you mean. The key the pulumi binary uses to authenticate to app.pulumi.com from within the pipeline should be its own Pulumi user account. Agreed, in which case this would tip us over to 4 users. Need to check with our customer if they're happy to pay that jump from $50 to $300 if all we'd really be using is the language framework. Everything else is done in Azure DevOps.