need to delete Azure Managed HSM Purge Protection.

Manohara C 0 Reputation points
2026-06-02T06:28:04.66+00:00

During testing, Azure Managed HSM resources were created with Purge Protection enabled, and a 90-day retention period configured. The resources have since been deleted; however, due to the immutable purge protection setting, we are unable to permanently purge or remove the resources in PAYG and MPN Subscriptions.

We have already attempted the deletion process, but the purge operation is blocked because purge protection is enabled. As per Azure documentation, this setting cannot be disabled or modified after creation.

Azure Dedicated HSM
Azure Dedicated HSM

An Azure service that provides hardware security module management.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator
    2026-06-02T19:59:40.6466667+00:00

    Hi Manohara C,

    Thanks for reaching out in Microsoft Q&A forum.

    It looks like you’ve hit the immutable-purge-protection guard on Managed HSM, once you flip that switch on a pool, there’s no way to turn it off or bypass it (not even with a support ticket). Here’s the deal:

    What’s happening

    • Purge protection locks down your soft-deleted HSM for the entire retention window (90 days in your case).
    • During that window you can recover the HSM if you need to, but you can’t permanently purge it until the period expires.
    • After 90 days, Azure automatically purges the HSM and you’re free to recreate pools or keys with the same name.

    Your remediation options

    1. Wait for the 90-day soft-delete retention to lapse. Once that timer finishes, Azure will auto-purge the HSM.
    2. If you need the name sooner, you’ll either have to pick a new HSM name in the meantime or plan your deployments around the retention window.

    Unfortunately, there’s no CLI/PowerShell/API trick or subscription workaround that overrides purge protection. It’s baked into the service to protect against malicious or accidental permanent deletes.

    References

    Hope that clarifies why it’s stuck and why the only real path forward is to let the retention period run its course.

    Please do not forget to 210246-screenshot-2021-12-10-121802.pngand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    Was this answer helpful?

  2. AI answer

    2026-06-02T06:28:27.0033333+00:00

    Purge protection on Azure Managed HSM is immutable and can't be disabled or shortened after the HSM is created. When purge protection is enabled, any deleted Managed HSM or key is retained for the full configured retention period and can't be purged before that period ends.

    Key implications for the described scenario:

    1. Soft-delete is always on and can't be disabled. A deleted Managed HSM remains recoverable for the configured retention period (7–90 days, default 90 days).
    2. When purge protection is enabled, permanent deletion (purge) of the Managed HSM or its keys is blocked until the retention period expires. No administrator role or permission can override this behavior, and it can't be disabled or overridden by anyone, including Microsoft.
    3. While the Managed HSM is in a soft-deleted state, it continues to incur billing charges until it is automatically purged at the end of the retention period.
    4. The only way to fully remove those specific HSM resources is to wait until the configured retention period elapses, at which point the service will automatically purge them.

    There is no supported mechanism to:

    • Turn off purge protection after creation.
    • Shorten or change the retention period after the HSM is created.
    • Force an immediate purge of a Managed HSM or key when purge protection is enabled.

    For future test environments, consider:

    • Using a shorter retention period (minimum 7 days) when creating Managed HSM instances if they are strictly for testing.
    • Avoiding enabling purge protection on short-lived test HSMs, since purge protection is optional and off by default.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.