Events
Sep 15, 6 AM - Sep 17, 3 PM
The best SQL community-led learning event. Sept 2025. Save €200 with code FABLEARN.
Get registeredThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Applies to:
SQL Server 2019 (15.x) and later - Windows only
Azure SQL Database
In Always Encrypted, a key rotation is a process of replacing an existing column master key or a column encryption key with a new key. This article describes use cases and considerations for key rotation specific to Always Encrypted with secure enclaves when either the initial key and/or the target (new) key is an enclave-enabled key. For general guidelines and processes for managing Always Encrypted keys, see Overview of key management for Always Encrypted.
You may need to rotate a key for security or compliance reasons. For example, if a key has been compromised or your organization's policies require you to replace keys periodically. In addition, Always Encrypted with secure enclaves key rotation provides a way to enable or disable the functionality of the server-side secure enclave for your encrypted columns.
If you're rotating a key only for security/compliance reasons, and not to enable or disable enclave computations for your columns, make sure the target key has the same configuration regarding enclaves as the source key. For example, if the source key is enclave-enabled, the target key should also be enclave-enabled.
The below steps include links to detailed articles, depending on your rotation scenario:
Provision a new key (a column master key or a column encryption key).
Note
When using Azure Key Vault as the key store, multitenant customer managed key rotation is not supported. Ensure that the new customer managed key is in the same tenant as the existing one.
Replace an existing key with the new key.
Events
Sep 15, 6 AM - Sep 17, 3 PM
The best SQL community-led learning event. Sept 2025. Save €200 with code FABLEARN.
Get registered