I am setting up roles as a layer of protection inside of MSSQL. One of the roles will only have the ability to change database encryption keys for TDE on the database server. The server will be using EKM to supply the keys.

I have not been able to find the exact process to exchange the keys with EKM. Since I can't find the process, I can't give the roles the permissions it needs.

Right now, I have granted CONTROL permissions on certificates and asymmetric keys at the database level. I am assuming that this will be necessary.

Does anyone know if there are any server level permissions required to change the database encryption key? I believe that the user will at least need to have access to which keys are located in EKM.

| improve this question | | | | |


Requires CONTROL permission on the database and VIEW DEFINITION permission on the certificate or asymmetric key that is used to encrypt the database encryption key.

You must also add view definition according to MSDN.


| improve this answer | | | | |
  • This is helpful, but it is pulled straight out of the official docs. I was asking specifically about server level permissions, and both of these permissions are at the database level. – Leland Barton Aug 13 '15 at 14:20
  • GRANT CONTROL SERVER TO [ABC] this is a server level permission which give a lot of power. – Julien Vavasseur Aug 13 '15 at 14:38
  • I am trying to give the minimum level of permission necessary to complete the changing of keys. – Leland Barton Aug 13 '15 at 14:40
  • I know. but DENY > GRANT. therefore you can add a bunch of DENY such as DENY VIEW ANY DATABASE TO, DENY VIEW ANY DEFINITION, ALTER ROLE [db_denydatawriter] ADD MEMBER – Julien Vavasseur Aug 13 '15 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.