A contractor wants Always Encrypted “turned on at the server” for lock-lab Azure SQL the same way TDE is enabled. What must you explain?
Select an answer to reveal the explanation.
Short Explanation
Always Encrypted isn’t a light switch on the SQL server. The app’s driver does the crypto, and the column master key stays with the client or in Key Vault—SQL never gets the “read everything” keys.
Full Explanation
With Always Encrypted, plaintext column encryption keys are available to the client driver, and column master keys reside in a client certificate store or in Key Vault—not as a TDE-style server-only enablement. Applications must use a supporting driver, which is why the skill emphasizes recommending when to use the feature. SQL Database and Managed Instance store encrypted column data and metadata but must not be treated as the place that silently decrypts for every caller.