I'm moving an App to Azure and need to achieve PCI compliance for a couple columns in a single table. I realize I can encrypt the data before I store it, but I was wondering if there was a feature in SQL Azure that can manage part of this for me. I've done some reading but I'm not sure what is; or is not; supported in SQL Azure.

I've read about patterns using SQL Server (and not SQL Azure) where data encryption & decryption was applied behind a View. In that case, all clients accessed data via a View and consequently were abstracted from the Encryption/Descryption process. With that said, it seems a bit dangerous.

I'm open to any and all suggestions on how to deal with this situation.


Short answer: as of April 20, 2012 column encryption is not supported in SQL Azure, see: http://msdn.microsoft.com/en-us/library/windowsazure/ee336253.aspx and search for ENCRYPT. You will see that all of the encryption functions are listed as unsupported.

If you need to encrypt your data at rest and have to support SQL Azure then you are going to have to do your encryption at the application level. This is more difficult to get right as lots of the good encryption practices (using nonces as initialization vectors for each cell, key management for tracking which keys encrypt which columns, integrity verification, layered protection of encryption keys with role based permissions) you will have to implement yourself. I strongly recommend getting a security professional to work with you on the encryption as it is challenging to get right and if you miss something then you have a false sense of security that could really burn you later.

You could look at http://securentity.codeplex.com, which claims to be a solution for managing encrypted data and supports SQL Azure. I have not personally used it, nor can I vouch for it's correctness, but it is a potential option.

Other information:

In SQL Server column level encryption is easy and very secure (even with a view) because you can use roles to manage who can access the encryption keys. Even if a user can select from a view, if they are not granted access to the key that encrypts the underlying data then they will get back NULLs for those encrypted columns. I have a set of sample code for SQL Server 2005 and higher that demonstrates the encryption capabilities of SQL Server here: http://sqlcrypto.codeplex.com

| improve this answer | |

Windows Azure is Level 1 compliant under the Payment Card Industry (PCI) Data Security Standards (DSS) as verified by an independent Qualified Security Assessor (QSA), allowing merchants to establish a secure cardholder environment and to achieve their own certification.


To encrypt a SQL table hosted in Azure, the easiest route is to simply spin up a SQL IaaS instance, and enable TDE or column level encryption. (Rather than use the SQL Azure PaaS product, which doesn't support transparent data encryption or cell level encryption).

There are a lot of other security requirements to consider in addition to encrypting credit card numbers though.

| improve this answer | |

As of today, regarding MSDN article and the compatibility information provided by Microsoft Docs, both features listed below are available in Azure SQL Database (PaaS).

So you can simply use those features to meet your requirements and keep the whole process of encryption behind the scenes.

Here is a link to an overall summary which present security aspects of Azure databases and could be starting point to prepare an appropriate security architecture.

From my experience, I can tell, that you should be careful if your system is divided between Azure and OnPremises environments. In this case, there could be a bit of difficulty setting everything up (authorization, synchronization).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.