An Azure service that provides hardware security module management.
Purge protection on Azure Managed HSM is immutable and can't be disabled or shortened after the HSM is created. When purge protection is enabled, any deleted Managed HSM or key is retained for the full configured retention period and can't be purged before that period ends.
Key implications for the described scenario:
- Soft-delete is always on and can't be disabled. A deleted Managed HSM remains recoverable for the configured retention period (7–90 days, default 90 days).
- When purge protection is enabled, permanent deletion (purge) of the Managed HSM or its keys is blocked until the retention period expires. No administrator role or permission can override this behavior, and it can't be disabled or overridden by anyone, including Microsoft.
- While the Managed HSM is in a soft-deleted state, it continues to incur billing charges until it is automatically purged at the end of the retention period.
- The only way to fully remove those specific HSM resources is to wait until the configured retention period elapses, at which point the service will automatically purge them.
There is no supported mechanism to:
- Turn off purge protection after creation.
- Shorten or change the retention period after the HSM is created.
- Force an immediate purge of a Managed HSM or key when purge protection is enabled.
For future test environments, consider:
- Using a shorter retention period (minimum 7 days) when creating Managed HSM instances if they are strictly for testing.
- Avoiding enabling purge protection on short-lived test HSMs, since purge protection is optional and off by default.
References:
and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.