Protects the column encryption keys in Always Encrypted. It never lives in the database itself but in Azure Key Vault or the Windows certificate store, and client apps need permission to use it.
Also called CMK (Always Encrypted).
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Column master key in context, with comparison tables and the common traps.
Terms in this definition
- Encryption
Scrambling data so it cannot be read without the correct secret key, which is then used to turn it back again. Hashing, by contrast, cannot be reversed.
- Always Encrypted
Client-side encryption of SQL columns using keys never revealed to the database engine, meaning cloud administrators and DBAs only ever see ciphertext.
- Schema
The middle part of a Unity Catalog name (
catalog.schema.table), grouping tables, views, volumes, functions and models inside a catalog. A grant on it covers everything in it now and later, and nothing inside can be reached withoutUSE SCHEMA. - Azure Key Vault
Azure service holding secrets, keys and certificates. If the region has a paired region in the same geography, contents replicate to it, and during a best-effort failover initiated by Microsoft the vault can only be read.
- Windows certificate store
A key store local to Windows that can hold Always Encrypted column master keys. Since App Service managed identities cannot access it, Key Vault is used in that case.