Hi. I just wanted to share my latest blog article about using Pulumi without Pulumi Service:
https://www.techwatching.dev/posts/pulumi-azure-backend
You will find there an azure cli script to provision the azure storage blob container to store the state and the azure key vault key to encrypt/decrypt the secrets.