Securing Always Encrypted SQL Server from "sa"

Question

I'm currently studying SQL Server Always Encrypted feature. How can I disable column decryption to "sa" if all they have to do is add Column Encryption Setting=enabled in the login's additional login parameters in SQL Server Management Studio?

I read articles in Google. They only said we can secure data from admins but no example how.

Answer 1

The column encryption key (CEK) is used to encrypt the data and is stored in the database. The CEK is secured using  a column master key (CMK).

The CMK is stored outside of SQL Server. Metadata about the key is stored within SQL Server.

If you restrict access to the CMK your database administrators / system administrators (sa) will not have the ability to decrypt.

Answer 2

You can't simply because the key all stored in the catalog, and the catalog is unrestricted to sa.

I didn't write the query, I just googled for sys.column_encryption_key_values (which I knew stored the sym encryption keys), and found someone else who did the work.

SELECT cek.name, cmk.key_path, cekv.encrypted_value, cekv.encryption_algorithm_name
FROM sys.column_encryption_key_values cekv, sys.column_encryption_keys cek, sys.column_master_key_definitions cmk
WHERE cek.column_encryption_key_id = cekv.column_encryption_key_id
   AND cmk.column_master_key_definition_id = cekv.column_master_key_definition_id;

All bets are off with symmetric encryption if someone gets root.