Always Encrypted protects individual columns so that even database administrators never see plaintext. It is the choice when data owners must be kept apart from the people who run the database.
- Always Encrypted gives column-level encryption. The client driver encrypts and decrypts, so the engine never sees keys or plaintext and can’t provision keys. DBAs and cloud operators see only ciphertext. Choose it over TDE when data owners must be kept apart from administrators. Figure 6.1 compares where Always Encrypted, TDE and dynamic data masking each do their work.
- Column master key (CMK): held outside the database, in Azure Key Vault or the Windows certificate store.
- Column encryption key (CEK): stored in database metadata, encrypted by the column master key. The driver fetches it automatically and decrypts it with the CMK.
- Developers need their user credentials and access to the CMK. They never get the CEK.
Common trap: Giving developers both the column encryption key and the column master key - they need credentials and the CMK only; the CEK is protected by the CMK and delivered by the database.
- App Service apps: put the CMK in Azure Key Vault so the apps’ managed identities can reach it. Authorise the identities through a Key Vault access policy with key permissions get, unwrapKey and verify (wrapKey and sign are needed only by users who provision the keys). Managed identities can’t reach the Windows certificate store.
Common trap: Generating a key on an HSM device to let apps use the column master key - generating a key doesn’t authorise any identity to use it; a Key Vault access policy does.
- Azure Disk Encryption (disks at rest) and TLS (in transit) don’t hide data from DBAs. Stored access policies and SAS are Azure Storage concepts.
| Encryption type | Behaviour | Use for |
|---|---|---|
| Deterministic | Same plaintext always gives the same ciphertext, so it supports point lookups, equality joins, grouping and indexing. It can reveal patterns. | Exact-match values such as government ID numbers |
| Randomized | More secure; no equality operations | Data not searched by exact value, such as free-text comments |
- The legacy
imagedata type can’t be encrypted with Always Encrypted.