I deleted and purged Key Vault HSM Pool within an hour of creating

Question

I deleted and purged Key Vault HSM Pool within an hour of creating

Paul Rony 20

I created and deleted the Key Vault HSM Pool very quickly after creating. Why was I billed $2105.60 for May 2025? I see this charge on invoice G094872133.

Please fix this and make sure that I'm not charged. If I am charged, please refund immediately, before my credit card company requires me to pay.

Sanoop M 4,310 Reputation points Moderator

2025-06-06T16:40:07+00:00
Hello @Paul Rony,

Please note that if you have you created a Managed HSM Azure Key Vault with a purge protection enabled for certain time period(anywhere between 7 to 90 days), it remains in a soft-deleted state and cannot be permanently deleted until the retention period expires. During this time, you will continue to be billed for the Managed HSM Azure Key Vault. Once the retention period ends, the Managed HSM will be automatically purged.

Please refer to the below Screenshot for your reference where we can see the Purge protection has been enabled by going to Key vaults -> Select the Key vault which you have created -> Under Settings select Properties ->Under Purge protection you can see this below option to enable purge protection.

Enable purge protection (enforce a mandatory retention period for deleted vaults and vault objects)

The Managed HSM soft-delete feature allows recovery of deleted HSMs and keys. Specifically, this feature provides the following safeguards:

After an HSM or key is deleted, it remains recoverable for a configurable period of 7 to 90 calendar days. You can set the retention period when you create an HSM. If you don't specify a value, the default retention period of 90 days will be used. This period gives users enough time to notice an accidental key or HSM deletion and respond.

To permanently delete a key, users need to take two actions. First, they must delete the key, which puts it into the soft-deleted state. Second, they must purge the key in the soft-deleted state. The purge operation requires the Managed HSM Crypto Officer role. These extra safeguards reduce the risk of a user accidentally or maliciously deleting a key or an HSM.

Purge protection

Purge protection is an optional behavior. It's not enabled by default. You can turn it on by using the Azure CLI or PowerShell.

When purge protection is on, an HSM or key in the deleted state can't be purged until the retention period ends. Soft-deleted HSMs and keys can still be recovered, which ensures the retention policy will be in effect.

The default retention period is 90 days. You can set the retention policy interval to a value from 7 to 90 days when you create an HSM. The retention policy interval can be set only when you create an HSM. It can't be changed later.

Billing implications

Managed HSM is a single-tenant service. When you create a managed HSM, the service reserves underlying resources allocated to your HSM. These resources remain allocated even when the HSM is in a deleted state. You'll be billed for the HSM while it's in a deleted state.

Reference documents which will be helpful:

Azure Key Vault Managed HSM soft-delete | Microsoft Learn

Azure Key Vault recovery overview | Microsoft Learn

Azure Key Vault Managed HSM recovery overview | Microsoft Learn

Once you have permanently deleted the Managed HSM Keyvaults, it will stop billing.

You can confirm that by going to Key vaults ->Manage deleted vaults and see if the deleted keyvault is showing under key vaults list as mentioned in the below Screenshot.

Please note that if you are seeing as same as shown in the above screenshot, then the billing will be stopped.
Paul Rony 20 Reputation points

2025-06-06T17:18:27.27+00:00

Here is a simple thought/solution. If a deleted HMS vault has no keys, certificates or secrets and none were ever added, then purge should not be necessary and $2000/month for 3 months should not be charged.
Paul Rony 20 Reputation points

2025-06-06T17:22:07.0933333+00:00

Or, how about this. If I decide that I do not want to pay the $2000/month after I decide to purge, I should not be forced to pay it. I don't care what configuration I set, if I don't want to pay for a service that I have cancelled, I should not be required to do so. I'm sure American Express will back me up on this as it is part of their terms of service to Microsoft.

2 answers

Your answer

Paul Rony 20 Reputation points

2025-06-06T17:18:27.27+00:00

Here is a simple thought/solution. If a deleted HMS vault has no keys, certificates or secrets and none were ever added, then purge should not be necessary and $2000/month for 3 months should not be charged.
Paul Rony 20 Reputation points

2025-06-06T17:22:07.0933333+00:00

Or, how about this. If I decide that I do not want to pay the $2000/month after I decide to purge, I should not be forced to pay it. I don't care what configuration I set, if I don't want to pay for a service that I have cancelled, I should not be required to do so. I'm sure American Express will back me up on this as it is part of their terms of service to Microsoft.

Answer 1

TP 126.3K Volunteer Moderator

Hi Paul,

I recommend you create a billing support request so that you can discuss with engineer and request refund. Billing support is free.

Please carefully follow my instructions below to create billing support request and avoid getting stuck in endless loop.

Please let me know that you were able to create ticket or if you had any issues.

1. Navigate to this link to start the process:

https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/~/overview

2. Click Create a support request button at top

User's image

3. If you see Support AI Assistant, click Switch to old experience button on right. Otherwise, continue to Step#4

User's image

4. On left, enter billing in the box and click Go

User's image

5. Select Billing and click Next

User's image

6. Select your subscription from the dropdown and click Next

7. At this point there will be a delay of several seconds, and then various options will be displayed. Click Create a support request button at the top. DO NOT CLICK any of the other options.

User's image

8. Fill out screen, Summary, Problem type, Problem subtype, then click Next button at bottom

9. There will be another several second delay, and then some solutions will be displayed (this is similar to above). DO NOT CLICK any of the solutions, instead click on Return to support request button in upper left corner, similar to below

azure support request Return to support request

10. Now you are back at support case. Click Next button at bottom to continue to Additional details tab. Fill out information as required, one of the items you may need is your Subscription ID.

You can open separate browser tab and navigate to your subscription in portal, the ID is there, click the copy button to the right of it, then paste it into the box on Additional details tab. Click Next to advance to Review + create tab, then click Create.

You should receive an automated email within a few minutes and then be contacted by support within 1 business day.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Paul Rony 20 Reputation points

2025-06-06T14:07:09.18+00:00

There was no Old experience option. I did get to a Request a refund, followed instructions, then it said failed, contact support. I don't seem to be able to contact support, only endless loop. AI sucks.
Paul Rony 20 Reputation points

2025-06-06T17:16:26.0533333+00:00

The HSM vault was created by mistake. To charge me $6000 for this mistake is a crime. I have already instructed American Express to dispute the charge and I guess I will continue to dispute for the next few months.

Please have someone fix this. I should not be penalized for such an accident.

The billing support is also a failure as it is not allowing me to contact someone at billing to resolve this issue.
TP 126.3K Reputation points Volunteer Moderator

2025-06-06T18:31:02.0733333+00:00

The billing support is also a failure as it is not allowing me to contact someone at billing to resolve this issue.

Paul, please give my instructions a try again and follow them carefully. I purposefully asked to NOT click on any of the solutions like "Request refund" because this will prevent you from opening actual case so you can speak to someone.Additionally pay close attention to step#9 where you have to click on Return to support request.

I know it's confusing process, but if you follow my instructions carefully it will allow you to get billing support case created so that you can speak to actual person.

Please let me know if you run into any issues creating the support request.
TP 126.3K Reputation points Volunteer Moderator

2025-06-06T18:34:20.1333333+00:00

There was no Old experience option. I did get to a Request a refund, followed instructions, then it said failed, contact support. I don't seem to be able to contact support, only endless loop. AI sucks.

In that case, continue to step#4. It is in my instructions.
TP 126.3K Reputation points Volunteer Moderator

2025-06-07T07:29:20.7233333+00:00

@Paul Rony Any update? Were you able to create billing support ticket using my instructions?
Paul Rony 20 Reputation points

2025-06-07T18:36:37.68+00:00

I'm still unable to get support. The steps you suggest in #4 do not follow the same results you predict. On step 9 where you say to go back, it does not provide an option for Additional Details. Only "Click here to view the solutions again"

So, I still can't get billing support.

Here is a suggestion, how about you give me a phone number to call. Or, how about you contact support directly and have them contact me directly. The invoice number that I provided should give billing support all the information they need to process the refund and prevent further charges on the cancelled service.
TP 126.3K Reputation points Volunteer Moderator

2025-06-07T21:42:45.23+00:00

@Paul Rony In the screenshot you posted, you need to click Next button at the bottom, which will advance you to Additional details tab. Step#10.

Please try again, you're almost there!

In regards to your suggestion, it sounds great, but I have no ability to do that. I'm a volunteer here. Creating support case is confusing, which is why I wrote out all the instructions.
TP 126.3K Reputation points Volunteer Moderator

2025-06-09T07:18:09.01+00:00

@Paul Rony Any update? Just checking in to see if you read my last comment.

Thanks.
Paul Rony 20 Reputation points

2025-06-09T15:14:55.2866667+00:00

Things are getting worse as I'm now getting emails from Microsoft that threaten to discontinue services. Apparently, Microsoft will not make it easy for me to contact billing, but if American Express reverses a charge, they respond immediately.

Please contact billing on my behalf and get the process rolling to cancel current and future charges. There does not seem to be any way for me to contact billing directly, either by phone, email or web. Just and endless loop of denial.
TP 126.3K Reputation points Volunteer Moderator

2025-06-09T16:01:34.8433333+00:00

@Paul Rony Did you read my last comment? You were almost finished creating billing support ticket, you just needed to click Next, fill out Additional Details tab, click Next, and then click to submit ticket. It was right there in the screenshot you posted.

I'm volunteer here. I don't have ability to contact Billing on your behalf.
Sanoop M 4,310 Reputation points Moderator

2025-06-10T07:29:46.1166667+00:00

Hello @Paul Rony,

Please let us know if you are still unable to create a support ticket with Billing team by following the steps as suggested by TP.

I can guide you in creating a support ticket with Billing team. I have initiated the Private Message and please provide those requested details in the Private Message so that we can connect offline to help you in creating a support ticket with Billing team.
Paul Rony 20 Reputation points

2025-06-10T07:46:48.9333333+00:00

I am still unable to connect to billing team.
Sanoop M 4,310 Reputation points Moderator

2025-06-10T08:17:13.3433333+00:00

Hello @Paul Rony,

Please look into the Private Message and we can connect offline.
TP 126.3K Reputation points Volunteer Moderator

2025-06-11T13:34:37.6966667+00:00

@Paul Rony Did you get billing support ticket created? If you like you could share your screen and I could tell you step by step how to get case created.
Paul Rony 20 Reputation points

2025-06-11T15:37:26.4666667+00:00

Yes, the billing ticket was finally created. Sad that it was that difficult/not obvious to make happen.

Answer 2

Sanoop M 4,310 Moderator

Hello @Paul Rony,

You have initially created a Managed HSM Key vault and you have deleted and purged Key Vault HSM Pool within an hour of creating and even after deleting the Key vault, the billing amount got generated and now you need refund for the billing amount which was generated.

You tried to create a support ticket with Billing team by following the steps suggested by TP, but unfortunately you were facing the issue in creating a support ticket with Billing team.

Thank you for connecting offline. We have guided you in creating a support ticket with Billing team over the call and we have provided you the support ticket number over the Private Message for your reference.

I can see that the support ticket has been assigned to the engineer from Billing team and is actively working with you in resolving this issue.

Please reach out to me if you need any further assistance.

Paul Rony 20 Reputation points

2025-06-16T17:09:36.15+00:00

Billing says the system is still running so they want to billing me. I can't see it. I can't delete it. How do I kill this thing if I can't see in the UI or in the CLI pull of resources?
TP 126.3K Reputation points Volunteer Moderator

2025-06-16T19:01:44.5533333+00:00
If you run below command in Azure Cloud Shell does it show anything?

az keyvault list-deleted
Paul Rony 20 Reputation points

2025-06-16T21:45:43.4133333+00:00

PS C:> az keyvault list-deleted

[]

PS C:>
TP 126.3K Reputation points Volunteer Moderator

2025-06-16T22:34:01.54+00:00

Do you have Activity log entries showing both that you deleted it and then purged it successfully? I would think that would be enough to give to billing to show that you shouldn't be charged. And they should be able to bring in technical to ask why it is showing as still existing.
TP 126.3K Reputation points Volunteer Moderator

2025-06-16T22:36:17.1433333+00:00

To cover all bases, do you have any other Azure subscriptions, maybe even ones in different Entra tenant? Just in case you created in two different subscriptions, and only deleted/purged in one of them.
Sanoop M 4,310 Reputation points Moderator

2025-06-17T05:14:33.4366667+00:00

Hello @Paul Rony,

I am just checking in to see whether do you have activity logs entries showing the details regarding the deletion and purging of Azure Key vault as suggested by TP.

If so, please provide those details to the Billing team so that they can further assist you in this issue.
Paul Rony 20 Reputation points

2025-06-17T14:45:12.9366667+00:00

275120f0-4fcd-4512-bd88-bb4b87accd33 Delete Managed HSM Succeeded Administrative Informational 2025-05-04T02:12:42.878Z f45ca3a4-42ec-4e0d-95e9-0651ed60e187 ******@splendidcrm.com Microsoft.KeyVault/managedHSMs HowToForAFee /subscriptions/f45ca3a4-42ec-4e0d-95e9-0651ed60e187/resourcegroups/HowToForAFee/providers/Microsoft.KeyVault/managedHSMs/HowToForAFee

275120f0-4fcd-4512-bd88-bb4b87accd33 Delete Managed HSM Started Administrative Informational 2025-05-04T02:08:30.119Z f45ca3a4-42ec-4e0d-95e9-0651ed60e187 ******@splendidcrm.com Microsoft.KeyVault/managedHSMs HowToForAFee /subscriptions/f45ca3a4-42ec-4e0d-95e9-0651ed60e187/resourceGroups/HowToForAFee/providers/Microsoft.KeyVault/managedHSMs/HowToForAFee

275120f0-4fcd-4512-bd88-bb4b87accd33 Delete Managed HSM Accepted Administrative Informational 2025-05-04T02:08:32.260Z f45ca3a4-42ec-4e0d-95e9-0651ed60e187 ******@splendidcrm.com Microsoft.KeyVault/managedHSMs HowToForAFee /subscriptions/f45ca3a4-42ec-4e0d-95e9-0651ed60e187/resourceGroups/HowToForAFee/providers/Microsoft.KeyVault/managedHSMs/HowToForAFee
TP 126.3K Reputation points Volunteer Moderator

2025-06-17T15:26:41.8866667+00:00

You should send the Delete and Purge entries through your existing billing support ticket so they have it. What you posted says Delete, do you have the Purge as well?

If not purged it would continue to be billed for duration of retention period.

I've been going over the various documentation once again and it seems there are some inconsistencies.

For example, when creating HSM pool via portal, there is below text that you have to agree to:

If we take this text in isolation, it suggests that you are agreeing to pay for full retention period (in this example 7 days) after deleting HSM, regardless of whether or not you purge it.

I don't think the wording is clear. My guess is it is attempting to warn you that if you Enable purge protection you will have to pay for entirety of retention period, but you have to select this check box even if you leave purge protection Disabled.

Now, if the text is not taken in isolation, it seems that, assuming that purge protection is Disabled, if you Delete and Purge the HSM pool, billing will stop as soon as Purge completes, subject to billing granularity (e.g. it might round up to each full hour).

Below text from documentation supports this non-isolated interpretation:

"until they're purged" - Seems pretty clear that if you Purged the HSM Pool (as you mentioned), then billing should stop.

Above interpretation is consistent with some other Azure services.

There is another documentation page that warns that HSM will still accrue charges even in deleted state, however, it does not say you will still be charged after you purge it. Below is excerpt:

Because the underlying resources remain allocated to your HSM even when it's in a deleted state, the HSM resource will continue to accrue hourly charges while it's in that state.

My guess is that something may have gone wrong with the purge, leaving the HSM Pool existing and thus accruing charges.

What are your thoughts?

Share via

I deleted and purged Key Vault HSM Pool within an hour of creating

2 answers

Your answer