Question

You manage an Azure SQL Database that stores regulated healthcare data. A compliance requirement states that the organization must control and rotate the encryption key used to protect data at rest, and Microsoft must not have access to the root key material. Transparent Data Encryption (TDE) is currently enabled using the service-managed key. What should you configure to meet the requirement with the least ongoing administrative effort?

Accepted Answer

Configure TDE with a customer-managed key (BYOK) stored in Azure Key Vault and grant the server's managed identity access to the key

Answer

Disable TDE and implement Always Encrypted on every column that contains sensitive data

Answer

Enable TDE with the default service-managed key and schedule a manual key rotation task each month

Answer

Enable Microsoft Entra ID authentication-only mode and rely on the built-in service-managed TDE key