Does Pulumi automatically refresh expired Azure AD service‑principal secrets?

Goal: Determine whether Pulumi can automatically detect and renew an expired Azure AD service‑principal secret when using static credentials, while maintaining least‑privilege access.

Constraints/uncertainty: Pulumi reads the secret from environment or config per command; static secrets are not auto‑refreshed, whereas Managed Identity or OIDC flows rely on the underlying Azure SDK to obtain fresh tokens. It is unclear if the Pulumi CLI or provider exposes a hook for external secret rotation or if users must implement their own refresh mechanism.

• Does Pulumi CLI provide a callback or environment variable to trigger secret retrieval just before a command runs?
• Can the Azure SDK’s DefaultAzureCredential be used with Pulumi to handle rotation without changes to the stack?
• What is the recommended pattern for integrating external secret‑rotation tools (e.g., Azure Key Vault) with Pulumi stacks to avoid manual token updates?