Azure Managed HSM accidentally created - deleted but unable to purge or raise support ticket

Question

Azure Managed HSM accidentally created - deleted but unable to purge or raise support ticket

I accidentally created an Azure Key Vault Managed HSM while setting up a proof-of-concept SharePoint scanning solution, but it wasnt used and was set up 100% in error.

The Managed HSM was discovered following thr first invocie and has now been deleted.

My concerns are:

1. Whether the deleted Managed HSM continues to incur charges while in a soft-deleted state.

Whether purge protection is preventing permanent deletion.

Whether there is any way to purge the HSM if I am Subscription Owner / Global Admin.

Whether anyone has successfully obtained billing relief for an accidental Managed HSM deployment.

Additional information:

• Subscription type: Pay as you go
• Region: UK
• Current status: Deleted
• Unable to raise a support ticket through Azure portal or Billing to contact any one

Any guidance would be appreciated, particularly around ongoing billing and purge options.

Answer 1

Hi Michael McCoy FDThank you for reaching out and for clearly outlining your scenario.

Based on the behavior of Azure Key Vault Managed HSM, the scenario you’re experiencing is expected due to the service design. Please see the clarifications below:

When a Managed HSM is deleted, it does not immediately stop billing.

• Azure Managed HSM uses soft-delete, which retains the resource for a configured retention period (typically 7–90 days).
• During this time, the underlying dedicated HSM infrastructure remains allocated, and therefore billing continues at the full hourly rate.

This is clearly documented here:Azure Key Vault Managed HSM soft-delete overview

2. Purge protection behavior: If purge protection was enabled at the time of creation, then:

• The Managed HSM cannot be permanently deleted (purged) until the retention period expires.
• This restriction cannot be overridden by any role, including Subscription Owner, Global Admin, or Microsoft.

Official documentation: Managed HSM recovery (soft-delete and purge protection)

3. Can you purge the HSM now?

• If purge protection is NOT enabled → You can manually purge the HSM (using portal/CLI with appropriate roles).
• If purge protection IS enabled → Manual purge is not possible, The resource will be automatically purged after the retention period

4. Why charges continue:

Even though the HSM shows as “Deleted”:

• The service still maintains the allocated capacity to allow recovery.
• Billing continues until:
  • The resource is manually purged, OR
    • The retention period expires and Azure auto-purges it

There is no automatic refund for this scenario, as the behavior aligns with the product design.

However, you can request billing review/credit from the Azure Billing team:

• Raise a support request under Billing → Unexpected charges
• Billing support is free for all Azure subscriptions

Support request entry point:

• Create an Azure support request

If you're unable to create a ticket via the portal:

• Navigate to Help + Support
• Select Billing category
• If stuck in recommendations, click**“Return to support request”** and continue

Thanks,

Suchitra.

Answer 2

Hello Michael McCoy FD,

Welcome to Microsoft Q&A,

1. Yes, unfortunately. The docs state explicitly:

   "Soft-deleted Managed HSM resources will continue to be billed at their full hourly rate until they're purged."

   The underlying resources remain allocated even in a deleted state. Purging it as soon as possible is the only way to stop charges.
2. Only if it was explicitly enabled when the HSM was created. Purge protection is not enabled by default. It requires a deliberate --enable-purge-protection flag. If it wasn't set during your accidental creation, you can purge right now. If it was enabled, no one, not even Microsoft, can override it until the retention period ends (default 90 days). To check whether purge protection is on, run:

      az keyvault show --subscription <subscription-id> -g <resource-group> --hsm-name <hsm-name>
   

3. Subscription Owner and Global Admin are not sufficient on their own, you need the Managed HSM Contributor role to purge soft-deleted HSMs. As Owner, you can assign this to yourself.
   az keyvault purge --subscription <subscription-id> --hsm-name <hsm-name> --location <location>

      
         [https://learn.microsoft.com/en-us/cli/azure/keyvault?view=azure-cli-latest#az-keyvault-purge](https://learn.microsoft.com/en-us/cli/azure/keyvault?view=azure-cli-latest#az-keyvault-purge)
         
   

4. Billing relief is handled via Azure Billing Support. To raise a ticket when the portal option isn't working, go directly to: https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade Select Billing as the issue type. Billing support is free on all plans, including Pay-As-You-Go. Explain that it was an accidental creation that was never activated or used. Microsoft reviews these on a case-by-case basis and has granted credits for genuine accidental deployments.

Please Upvote and accept the answer if it helps