Managed HSM pool on a non-production resource
A Key Vault Managed HSM pool tagged non-production.
Why it happens
A Key Vault Managed HSM pool is single-tenant hardware billed by the hour it exists, with no idle rate and no smaller size: about $2,336 a month at the lowest regional rate and up to $2,920, whether it holds one key or ten thousand. It buys single-tenancy and FIPS 140-2 Level 3 validation, neither of which a development or test pool exercises. Key Vault Premium already stores HSM-protected keys at about $1.00 per key per month, so the same non-production work is usually served by a Premium vault at a fraction of the cost. The figure quoted is the pool fee only; the replacement vault is not priced here because the key count lives in the data plane where Resource Graph cannot see it.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.keyvault/managedhsms'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
// A soft-deleted pool is still returned by Resource Graph but is no longer billed, so it is not a saving.
| extend provisioningState = tostring(properties.provisioningState)
| where provisioningState !in~ ('Deleting', 'Deleted')
| extend hsmSku = tostring(coalesce(sku.name, sku.family))
| project name, resourceGroup, location, sku = hsmSku, provisioningState, environment = cfopEnvA Managed HSM pool is single-tenant hardware billed by the hour it exists, with no idle rate and no smaller size: about $2,336 a month at the lowest regional rate and up to $2,920, whether it holds one key or ten thousand. Verified against the retail API across all 64 regions that publish the meter, where 'Key Vault HSM Pool' carries exactly one meter, 'Standard B1 Instance'. The 'Operations' meters that look like a second charge belong to the ordinary vault, not the pool. Key Vault Premium stores HSM-protected RSA 2048-bit keys at about $1.00 per key per month, which is the usual alternative for non-production work; the replacement is not priced by the check because the key count lives in the data plane where Resource Graph cannot see it. This is a structural test, so what it returns is what the check reports.
Applies to microsoft.keyvault/managedhsmsWhat the agent does about it
A Key Vault Managed HSM pool tagged non-production.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
Idle virtual machine
A running VM whose CPU and network have been near zero for the whole window.
Oversized virtual machine
A running VM whose sustained peak fits comfortably inside the next size down.
Unattached managed disk
A managed disk attached to nothing, billing its full provisioned size every month.