Unexpected Billing After Deleting and Purging Azure Key Vault Managed HSM

Boris D 20 Reputation points
2026-04-29T17:27:19.95+00:00

Question:

By mistake, I created an Azure Key Vault Managed HSM instead of a regular Key Vault in Microsoft Azure.

As soon as I received the notification email, I deleted it because it was created unintentionally, and I wasn’t using any resources from it. After searching online, I found a lot of conflicting information and wasn’t sure what was correct.

I deleted the Managed HSM about one day ago, along with all the Resource Groups I had in Azure. Later, I realized that to stop billing completely, I also needed to perform a purge.

I initiated the purge today. After 2–3 hours, the status showed as "Succeeded", which I confirmed in my Azure Subscription → Activity Log.

However, even after that, I noticed that the billing amount continued to increase over the next 2–3 hours.

I checked other forums, where it was suggested to run the following command:

az keyvault list-deleted

This returns an empty array ([]) in my case.

I also tried:

az keyvault key list --hsm-name

Azure Dedicated HSM
Azure Dedicated HSM

An Azure service that provides hardware security module management.

0 comments
Answer accepted by question author
Siva shunmugam Nadessin 10,900 Reputation points Microsoft External Staff Moderator
2026-04-29T18:28:29.3066667+00:00

Hello Boris D,

Thank you for reaching out to the Microsoft Q&A forum. 

When investigated it looks like you’ve done everything correctly by deleting and then purging your Managed HSM – but you’re still seeing charges because of how Managed HSM soft-delete and billing work under the covers. Here’s the rundown and what you can do:

  1. Soft-delete retention and billing lag
    • Managed HSM has soft-delete enabled by default with a 90-day retention. When you delete an HSM, the service reserves and bills the underlying hardware until that HSM is fully purged.
    • Even after you run az keyvault purge, the portal’s usage and billing data can take several hours (or in rare cases up to 24 hours) to reflect the final state.
  2. Purge protection vs. soft-delete
    • Purge protection is optional (off by default). If it were on, you couldn’t purge until the retention period ended. Since it was off, your az keyvault purge command did succeed, but the backend de-allocation still needs to finish.
  3. What to check next
    • Run the exact CLI command to verify there are no soft-deleted HSMs left:
       az keyvault list-deleted \
   --subscription <your-sub-id> \
   --resource-type h
  4. You should see an empty array once the purge is fully processed.
  5. In the portal go to Cost Management + Billing → Cost analysis and filter by “Managed HSM” or by the resource name to see when usage stops.
  6. What to expect, You’ll still see charges for the hours (or days) the HSM was reserved until the purge fully completes. After that, no new HSM charges will appear in the next billing file or cost update cycle.
  7. If you still see new HSM charges 24 hours after your purge succeeded, you can open a support ticket to have billing take a final look.

References

Was this answer helpful?

1 person found this answer helpful.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. TP 162.3K Reputation points Volunteer Moderator
    2026-04-29T17:39:58.75+00:00

    Hi Boris,

    Billing for Azure resources is delayed. The exact amount of delay varies, but in general you should see charges stop accruing within 4-24 hours after deleting. The reverse is true as well--say you create a new resource (e.g. a VM), you will not start to see charges accruing for several hours, say 4-6 hours after creation.

    In regards to Purge Protection, it wouldn't have allowed you to purge it if purge protection was enabled, so you are okay there. Having entry in Activity Log showing the purge was successful is confirmation. The retention period doesn't apply since you were able to purge.

    Please click Accept Answer and upvote if the above was helpful.

    Thanks.

    -TP

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments

  2. AI answer

    2026-04-29T17:27:49.5733333+00:00

    For Managed HSM, soft-delete is always on and billing behavior is different from regular Key Vault, which explains the continued charges even after deletion and purge.

    Key points from the platform behavior:

    1. Soft-delete is mandatory and keeps the HSM billable until purge
      • Managed HSM always has soft-delete enabled and it cannot be turned off.
      • When an HSM is deleted, the underlying dedicated resources remain allocated and the HSM continues to be billed at the full hourly rate while in the deleted (soft-deleted) state, until it is purged.
      • This is explicitly called out: soft-deleted Managed HSM resources “will continue to be billed at their full hourly rate until they're purged.”
    2. Retention period and purge behavior
      • Managed HSM soft-delete retention is configurable 7–90 days, default 90 days, set at HSM creation time.
      • During that retention period, the HSM stays in a soft-deleted state and is still billable.
      • If not manually purged, the service automatically purges the HSM at the end of the retention interval.
      • After purge, the resource is permanently deleted and the name can be reused.
    3. Why costs can appear to increase after purge
      • Azure cost data is not real-time; there is a delay between resource usage and when it appears in Cost Management.
      • Charges accrued before the purge (including the time the HSM was active and the time it was in soft-deleted state) can continue to surface in the portal for some hours as usage is processed.
      • Once the HSM is purged, no new usage for that HSM should accrue, but previously incurred usage may still be posting to the bill for a short time.
    4. Why az keyvault list-deleted shows empty
      • If the purge completed successfully (as shown in Activity Log) and az keyvault list-deleted --resource-type hsm returns no entries, that means the Managed HSM has been fully purged and is no longer in soft-deleted state.
      • At that point, there is no way to query its retention settings because the resource no longer exists.
    5. How many retention days were set
      • The retention interval (7–90 days, default 90) is configured at HSM creation and cannot be changed later.
      • After the HSM is purged, there is no supported way to retrieve what retention value was used.
      • If no custom value was specified at creation, the default of 90 days would have applied while it existed, but that matters only for how long it would have stayed soft-deleted if not manually purged.
    6. Recommended next steps
      1. Confirm there are no remaining Managed HSMs or soft-deleted HSMs:
        • az keyvault list --resource-type hsm
        • az keyvault list-deleted --resource-type hsm
      2. Use Cost Management → Cost analysis → Cost by resource in the subscription to verify that no new usage is accruing for the purged HSM after the purge timestamp.
      3. Since this was an unintentional creation and the HSM is already purged, the correct path is the billing support ticket that is already open. Billing support can:
        • Validate that charges stop after the purge time.
        • Investigate any “stuck” billing if charges appear to continue.
        • Review and potentially adjust charges as a one-time courtesy where appropriate.

    To the specific questions:

    • Next step?
      Confirm via Cost by resource that no new usage is accruing for that HSM after the purge time, and continue working with Azure Billing Support on the existing ticket for charge review/waiver.
    • Is billing delayed?
      Yes. Cost data is delayed; charges can continue to appear for several hours after the resource is purged, but they represent past usage (while the HSM existed or was soft-deleted), not new usage.
    • Any way to check retention days now?
      No. Once the Managed HSM is purged, its configuration (including retention period) cannot be queried. While it existed, the retention was 7–90 days (default 90), but after purge this value is no longer accessible.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.