Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Transparent Data Encryption (TDE) protects your Azure SQL Database and Managed Instance by encrypting data at rest. It uses AES-256 to encrypt both database and log files without requiring changes to your applications. TDE automatically encrypts all data as it’s written to storage and decrypts it when read. By default, Azure SQL enables TDE on every newly created database, ensuring data-at-rest protection out of the box.
Key management in TDE follows a two-level hierarchy. The Data Encryption Key (DEK) is a symmetric key encrypted by a Master Key, which can be either service-managed or customer-managed. The DEK is the key that actually encrypts the database files; the Master Key protects the DEK itself. When you use service-managed keys, Azure automatically manages the Master Key. When you use customer-managed keys, you take control over the Master Key lifecycle through Azure Key Vault.
Using Bring Your Own Key (BYOK) with Azure Key Vault gives you control over key provisioning, rotation, and permissions. With BYOK, you can store and rotate the Master Key in Azure Key Vault, separate roles between security administrators and database administrators, and ensure centralized key management and auditability. This separation of duties is critical for compliance: the security admin manages the Key Vault and keys, while the database admin manages the databases but cannot access the raw key material.
To configure TDE with customer-managed keys, set up an encryption protector on your logical server. You assign a user-assigned managed identity to access the Key Vault, grant it wrapKey and unwrapKey permissions, and specify the Key Vault key identifier in the encryption protector settings. This setup can be done via the Azure Portal, Azure PowerShell (Set-AzSqlServerTransparentDataEncryptionProtector), or Azure CLI (az sql server tde-key set). Choosing between these tools depends on your automation preference: the Portal provides a visual interface, while PowerShell and CLI are suited for scripting and repeatable deployments.
Monitoring and verifying encryption status is critical for compliance. You can check the encryption state and key usage in the Azure Portal under the Transparent Data Encryption blade. Alternatively, use PowerShell or CLI commands to retrieve TDE protector settings and status. For automated monitoring, ingest Azure Monitor logs and set alerts for any changes to encryption protector or key expiration to maintain continuous compliance. This ensures that any unauthorized modification or key expiry is detected and remediated promptly.
Prepare and test your skills
Prepare and test your skills
Transparent Data Encryption (TDE) protects Azure SQL Database and Managed Instance by encrypting data at rest using AES-256, which encrypts database and log files without requiring application changes. TDE automatically encrypts data as it's written to storage and decrypts it when read, and it is enabled by default on every newly created Azure SQL database.
With service-managed keys, Azure automatically manages the Master Key that protects the Data Encryption Key (DEK). With customer-managed keys, you take control over the Master Key lifecycle through Azure Key Vault, which is part of the Bring Your Own Key (BYOK) approach.
You configure TDE with a customer-managed key by setting up an encryption protector on your logical server, assigning a user-assigned managed identity to access Key Vault with wrapKey and unwrapKey permissions, and specifying the Key Vault key identifier. This can be done via the Azure Portal, Azure PowerShell, or Azure CLI.
StudyCerts
StudyCerts