Hi. I just wanted to share my latest blog article about using Pulumi without Pulumi Service: https://www.techwatching.dev/posts/pulumi-azure-backend You will find there an azure cli script to provision the azure storage blob container to store the state and the azure key vault key to encrypt/decrypt the secrets.