First published on MSDN on Jul 11, 2016
I'm happy to announce Always Encrypted in Azure SQL Database is now generally available!
Always Encrypted is a feature designed to ensure sensitive data and its corresponding encryption keys are never revealed in plaintext to the database system. With Always Encrypted enabled, a SQL client driver encrypts and decrypts sensitive data inside client applications or application servers, by using keys stored in a trusted key store, such as Azure Key Vault or Windows Certificate Store on a client machine. As a result, even database administrators, other high privilege users, or attackers gaining illegal access to Azure SQL Database, cannot access the data.
Based on the feedback, we received during the preview of the feature, many of you have found Always Encrypted useful to achieve one or both of the following two goals:
-
To ensure the data is protected from malicious cloud database admins, co-tenants, or/and malware in Azure SQL Database. Always Encrypted can guarantee full isolation of data from the cloud provider when client applications or middle tier services are hosted on premises, but even for all-Azure apps, Always Encrypted substantially reduces attack the surface area, by removing the database from it.
-
To prevent the disclosure of sensitive data within customer's organization. With Always Encrypted, DBAs, who do not have access to the keys, can administer the database without having access to sensitive data in plaintext.
For more information:
We are looking forward to your feedback at:
