0

If you create a BACPAC of an encrypted database, will the data in the BACPAC be encrypted?

We're currently using on-prem SQL Server and use TDE to encrypt our customer databases. We also have a requirement to maintain customer directed backups for up to 10 years. A backup of an encrypted DB and retention is not an issue. We're looking to migrate our platform to Azure SQL DB and thus will lose the ability to do customer directed backups. I'm exploring the use of BACPAC to meet our needs. If you create a BACPAC of an encrypted database, will the data in the BACPAC be encrypted?

Improve this question

1 Answer 1

Reset to default
4

No, the BACPAC is not encrypted. BACPAC is an export of schema and data.

TDE means that decryption is done when SQL Server reads the data pages from disk. I.e., the client tool that generates the BACPAC (sqlpackage.exe, for example) asks SQL Server to read the data, and that tool will never see the encrypted data.

So you'd have to post-encrypt the BACPAC file by some tool, if you have such a requirement.

Improve this answer
1
  • Thanks Tibor. I thought that would be the case. I'm trying to get around the inability to perform customer specified backup & restore operations. I think I can get the BACPAC solution to work, but wanted to verify I'd need to encrypt the resulting BACPAC file.
    – SqlNightOwl
    Commented Feb 24, 2021 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.