Always Encrypted in Azure SQL Database is Generally Available
I'm happy to announce Always Encrypted in Azure SQL Database is now generally available!
Always Encrypted is a feature designed to ensure sensitive data and its corresponding encryption keys are never revealed in plaintext to the database system. With Always Encrypted enabled, a SQL client driver encrypts and decrypts sensitive data inside client applications or application servers, by using keys stored in a trusted key store, such as Azure Key Vault or Windows Certificate Store on a client machine. As a result, even database administrators, other high privilege users, or attackers gaining illegal access to Azure SQL Database, cannot access the data.
Based on the feedback, we received during the preview of the feature, many of you have found Always Encrypted useful to achieve one or both of the following two goals:
- To ensure the data is protected from malicious cloud database admins, co-tenants, or/and malware in Azure SQL Database. Always Encrypted can guarantee full isolation of data from the cloud provider when client applications or middle tier services are hosted on premises, but even for all-Azure apps, Always Encrypted substantially reduces attack the surface area, by removing the database from it.
- To prevent the disclosure of sensitive data within customer's organization. With Always Encrypted, DBAs, who do not have access to the keys, can administer the database without having access to sensitive data in plaintext.
To get started using Always Encrypted in Azure SQL Database, see the Always Encrypted - Protect sensitive data in SQL Database tutorial that shows how to configure Always Encrypted and develop a .NET application querying encrypted columns.
For more information:
- Visit the main Always Encrypted documentation page (recently updated and enhanced).
- Read other Always Encrypted articles on this blog.
We are looking forward to your feedback at: