Question

Your company runs an Azure SQL Database configured with Transparent Data Encryption (TDE) using a customer-managed key (CMK) stored in Azure Key Vault. The security team requires that the key be rotated every 90 days and that the database automatically use the newest key version without any downtime or manual reconfiguration of the database. What should you do to meet this requirement?

Accepted Answer

Enable auto-rotation on the Key Vault key and ensure the TDE protector is set to the key (without a specific version) so the database picks up new versions automatically.

Answer

Disable TDE, generate a new key manually every 90 days, then re-enable TDE pointing to the new key version.

Answer

Switch the database to service-managed TDE keys, which Microsoft rotates automatically every 90 days.

Answer

Create a scheduled Azure Automation runbook that exports the database, generates a new key, and restores the database against the new key version.