diff --git a/provider/pkg/provider/crud/crud.go b/provider/pkg/provider/crud/crud.go
index cf314f686c32..0d5291a987c3 100644
--- a/provider/pkg/provider/crud/crud.go
+++ b/provider/pkg/provider/crud/crud.go
@@ -11,6 +11,7 @@ import (
 	"github.com/pulumi/pulumi-azure-native/v2/provider/pkg/azure"
 	"github.com/pulumi/pulumi-azure-native/v2/provider/pkg/convert"
 	"github.com/pulumi/pulumi-azure-native/v2/provider/pkg/resources"
+	"github.com/pulumi/pulumi-azure-native/v2/provider/pkg/version"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/logging"
@@ -258,10 +259,13 @@ func (r *resourceCrudClient) currentResourceStateCheckpoint(ctx context.Context,
 	)
 }
 
-// checkpointObject puts inputs in the `__inputs` field of the state.
+// checkpointObject produces the checkpointed state for the given inputs and outputs.
+// In v2, we stored the inputs in an `__inputs` field of the state; removed in v3.
 func checkpointObject(inputs resource.PropertyMap, outputs map[string]interface{}) resource.PropertyMap {
 	object := resource.NewPropertyMapFromMap(outputs)
-	object["__inputs"] = resource.MakeSecret(resource.NewObjectProperty(inputs))
+	if version.GetVersion().Major < 3 {
+		object["__inputs"] = resource.MakeSecret(resource.NewObjectProperty(inputs))
+	}
 	return object
 }
 
diff --git a/provider/pkg/provider/provider.go b/provider/pkg/provider/provider.go
index f5fd1802bd8c..dbf2875e261b 100644
--- a/provider/pkg/provider/provider.go
+++ b/provider/pkg/provider/provider.go
@@ -34,6 +34,7 @@ import (
 	"github.com/pulumi/pulumi-azure-native/v2/provider/pkg/resources"
 	"github.com/pulumi/pulumi-azure-native/v2/provider/pkg/resources/customresources"
 	"github.com/pulumi/pulumi-azure-native/v2/provider/pkg/util"
+	"github.com/pulumi/pulumi-azure-native/v2/provider/pkg/version"
 	"github.com/pulumi/pulumi/pkg/v3/resource/provider"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
@@ -166,6 +167,11 @@ func (p *azureNativeProvider) Attach(context context.Context, req *rpc.PluginAtt
 func (k *azureNativeProvider) Configure(ctx context.Context,
 	req *rpc.ConfigureRequest) (*rpc.ConfigureResponse, error) {
 
+	if version.GetVersion().Major >= 3 && (!req.GetSendsOldInputs() || !req.GetSendsOldInputsToDelete()) {
+		// https://github.com/pulumi/pulumi-azure-native/issues/2686
+		return nil, errors.New("Azure Native provider requires Pulumi CLI v3.74.0 or later")
+	}
+
 	for key, val := range req.GetVariables() {
 		k.config[strings.TrimPrefix(key, "azure-native:config:")] = val
 	}
@@ -1578,10 +1584,13 @@ func azureContext(ctx context.Context, timeoutSeconds float64) (context.Context,
 	return context.WithTimeout(ctx, d)
 }
 
-// checkpointObject puts inputs in the `__inputs` field of the state.
+// checkpointObject produces the checkpointed state for the given inputs and outputs.
+// In v2, we stored the inputs in an `__inputs` field of the state; removed in v3.
 func checkpointObject(inputs resource.PropertyMap, outputs map[string]interface{}) resource.PropertyMap {
 	object := resource.NewPropertyMapFromMap(outputs)
-	object["__inputs"] = resource.MakeSecret(resource.NewObjectProperty(inputs))
+	if version.GetVersion().Major < 3 {
+		object["__inputs"] = resource.MakeSecret(resource.NewObjectProperty(inputs))
+	}
 	return object
 }
 
diff --git a/provider/pkg/version/version.go b/provider/pkg/version/version.go
index a8f9519fd919..d433d892430b 100644
--- a/provider/pkg/version/version.go
+++ b/provider/pkg/version/version.go
@@ -2,5 +2,16 @@
 
 package version
 
+import "github.com/blang/semver"
+
 // Version is initialized by the Go linker to contain the semver of this build.
 var Version string
+
+func GetVersion() semver.Version {
+	v := Version
+	if v == "" {
+		// fallback to a default version e.g. for unit tests (see: PROVIDER_VERSION in Makefile)
+		v = "2.0.0-alpha.0+dev"
+	}
+	return semver.MustParse(v)
+}