Why Encryption Matters

Data is often called the new oil of the digital world. Losing control of sensitive data can mean reputational damage, compliance fines, or breaches. Azure provides multiple layers of encryption for data at rest, in transit, and even while in use. Understanding when to use TDE, Always Encrypted, Key Vault, and Confidential Computing is crucial for the AZ-305 exam.

1. Transparent Data Encryption (TDE)

Definition:
Encrypts Azure SQL Database, Managed Instance, and SQL Server data at rest.

Features:

• Encrypts data, logs, and backups automatically.

• Enabled by default in Azure SQL.

• Can use:

  • Service-Managed Keys (SMK) → managed by Microsoft.

  • Customer-Managed Keys (CMK) → stored in Key Vault.

Use Cases:

• Meeting compliance (PCI DSS, HIPAA).

• Protecting databases without app changes.

2. Always Encrypted

Definition:
Column-level encryption for sensitive fields like SSNs, credit card numbers.

Features:

• Encryption/decryption happens in client application (keys never exposed to SQL engine).

• Even DBAs cannot see plaintext values.

• Supports deterministic and randomized encryption modes.

Use Cases:

• Protecting customer PII (Personally Identifiable Information).

• Preventing insider threats (admins can’t view data).

3. Azure Key Vault

Definition:
Centralized secrets, keys, and certificate management service.

Key Features:

• Store cryptographic keys, passwords, connection strings.

• Supports BYOK (Bring Your Own Key).

• Key rotation and versioning.

• Integration with TDE, Always Encrypted, and Storage Service Encryption.

Use Cases:

• Manage database encryption keys (CMK).

• Store API keys or certificates securely.

• Central governance for secrets in multi-team projects.

4. Customer-Managed Keys (CMK)

Definition:
Instead of Microsoft-managed keys, organizations use their own keys in Key Vault.

Benefits:

• Full control over lifecycle of keys.

• Regulatory compliance for industries requiring customer control.

• Ability to revoke Microsoft’s access to encrypted data.

5. Confidential Computing

Definition:
Protects data while in use using hardware-based Trusted Execution Environments (TEEs).

Key Services:

• Azure VMs with Intel SGX (secure enclaves).

• Confidential containers for workloads.

Use Cases:

• Highly regulated industries (finance, healthcare, defense).

• Secure multi-party computation.

Example Enterprise Scenario

A healthcare company requires:

• Database encryption at rest (regulatory compliance).

• Protecting patient PII from DBAs.

• Centralized key rotation and audit logs.

• Research workloads where sensitive data must stay encrypted even during processing.

Correct design:

• Enable TDE with CMK from Key Vault for SQL DB.

• Use Always Encrypted for sensitive columns (e.g., patient IDs).

• Store keys and secrets in Azure Key Vault.

• Deploy Confidential VMs with Intel SGX for research workloads.

Confusion Buster

• TDE vs Always Encrypted

  • TDE = encrypts database at rest.

  • Always Encrypted = encrypts individual columns, prevents insider access.

• Key Vault vs Managed Identity

  • Key Vault = stores secrets and keys.

  • Managed Identity = identity for apps to access Key Vault (no hardcoded creds).

• Service-Managed Keys vs Customer-Managed Keys

  • SMK = Microsoft handles key lifecycle.

  • CMK = Customer manages lifecycle via Key Vault.

• Confidential Computing vs TDE

  • TDE = protects data at rest.

  • Confidential Computing = protects data in use.

Exam Tips

• “Which SQL feature ensures admins cannot view SSNs?” → Always Encrypted.

• “Which service stores and rotates keys for encryption?” → Key Vault.

• “Which feature encrypts SQL DB backups by default?” → TDE.

• “Which option ensures customer owns and rotates encryption keys?” → CMK in Key Vault.

• “Which service protects data while it’s being processed?” → Confidential Computing.

What to Expect in the Exam

• Direct Q: “Which service stores database encryption keys for compliance?” → Key Vault.

• Scenario Q: “Bank must encrypt all databases at rest and rotate keys yearly.” → TDE with CMK in Key Vault.

• Scenario Q: “Healthcare system requires DBAs not to see patient IDs.” → Always Encrypted.

• Scenario Q: “Government agency requires workloads with encrypted data even during compute.” → Confidential Computing.

• Trick Q: “TDE prevents DBAs from reading sensitive columns.” → False (that’s Always Encrypted).