Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It only takes a minute to sign up.
Sign up to join this community
In Azure we have "SQL Database" and "SQL Server" - within SQL Database there is a toggle which states it will enable or disable transparent data encryption, first screenshot.
So an internal audit has flagged this as a risk, but the DB guys refer to the fact the CMK is enabled at "SQL Server" level, second screen shot.
Which has me pondering is the setting at "SQL Database" level entirely irrelevant? What does it actually do?
You can enable/disable TDE for each database in the database settings, but how the TDE keys are protected has to be set at the server level. Per Microsoft's documentation:
For Azure SQL Database and Azure Synapse Analytics, the TDE protector is set at the server level and is inherited by all encrypted databases associated with that server.
