Remove Managed HSM in KeyVault

Sergey Zarembo 6

I did create Managed HSM in Azure KeyVault for tests, but now I cannot delete it.
When I try to do it in Azure Portal, I'm getting an error:

**Executed delete command
Error details: The subscription is not registered or does not exist. (Code: BadRequest)"**

In the Powershell console I'm getting the error:

Remove-AzKeyVaultManagedHsm : Operation returned an invalid status code 'NotFound'

But in the same time the Managed HSM is still exists and continues to spend my expenses.

How should I delete the Managed HSM?

JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2022-05-11T22:06:47.9+00:00
@Sergey Zarembo
Thank you for your post!

Based off our Provision and activate a Managed HSM using PowerShell documentation, you should've been able to delete your Managed HSM by deleting the Resource Group that it was created in. If you're still being billed for the Managed HSM, it could be because - deleting the resource group puts the Managed HSM into a soft-deleted state. The Managed HSM will continue to be billed until it is purged.

From your error message, it looks like the Managed HSM was deleted since the resource can't be found, can you check the status of soft-delete and purge protection for your managed HSM? For more info.

Get-AzKeyVaultManagedHsm -Name "ContosoHSM"

If you're still being billed and want to remove the Managed HSM as soon as possible, I'd recommend working closer with our support team via an Azure support request.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Sergey Zarembo 6 Reputation points

2022-05-12T15:12:20.647+00:00

Thank you for answer.

I've applied Get-AzKeyVaultManagedHsm command and got the empty output only .

Also, I've tried to remove Resource group which contains Managed HSM, and I got the next error:
"Deletion of resource group 'bdashared' did not finish within the allowed time as resources with identifiers 'Microsoft.KeyVault/managedHSMs/szbdasdhared-hsm' could not be deleted. The provisioning state of the resource group will be rolled back. The subscription is not registered or does not exist."
JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2022-05-17T23:02:09.603+00:00
@SergeyZarembo-028
Thank you for following up on this and I apologize for the delayed response!

For the "bdashared" Resource Group that your Managed HSM is in, are you still able to see the HSM as a resource of that resource group?

Can you retry the resource group deletion to see if you're still running into the same error?

If you can't see the HSM within your resource group can you see if the below CLI command show you HSM in a soft-deleted state?

List all soft-deleted HSMs:

az keyvault list-deleted --subscription {SUBSCRIPTION ID} --resource-type hsm

If you have any other questions or would like to work closer with our support team on this, please let me know.
Thank you again for your time and patience throughout this issue!
JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2022-05-20T16:04:29.763+00:00

@Sergey Zarembo
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Petr Jaluvka 0 Reputation points

2023-03-16T08:48:53.91+00:00

@JamesTran-MSFT I have similar problem as Sergey. I've raised an Azure support request, but I got answer, that deletion of HSM with purge protection is not possible even for Microsoft. Can you please confirm that this is true?
Francesco 0 Reputation points

2023-04-05T09:58:32.8966667+00:00

Hello @JamesTran-MSFT Can you please update here? The portal is not clear enough regarding the HUGE consequences in term of costs. Not being able to destroy the HSM that's generating massive costs doesn't seem fair to customers.