{"id":17758,"date":"2020-08-25T12:28:10","date_gmt":"2020-08-25T12:28:10","guid":{"rendered":"https:\/\/www.testpreptraining.com\/tutorial\/?page_id=17758"},"modified":"2022-03-14T05:29:18","modified_gmt":"2022-03-14T05:29:18","slug":"configuring-always-encrypted-by-using-azure-key-vault","status":"publish","type":"page","link":"https:\/\/www.testpreptraining.ai\/tutorial\/configuring-always-encrypted-by-using-azure-key-vault\/","title":{"rendered":"Configuring Always Encrypted by using Azure Key Vault"},"content":{"rendered":"\n

Go back to AZ-500 Tutorials<\/a><\/p>\n\n\n\n

We will study and understand how to configure Always encrypted using the Azure key vault in this tutorial. Using the Always Encrypted wizard in SQL Server Management Studio, we’ll learn how to safeguard sensitive data in an Azure SQL Database database (SSMS).<\/p>\n\n\n\n

Always Encrypted is a data encryption solution that helps safeguard sensitive data on the server while it is in transit. Furthermore, it ensures that sensitive information is never stored in plaintext within the database system. Plaintext data can only be accessed by client programs or app servers that have access to the keys once data encryption has been configured.<\/p>\n\n\n\n

After setting the database to use Always Encrypted, you’ll use Visual Studio to construct a client application in C# to deal with the encrypted data.<\/p>\n\n\n\n

Enable client application access<\/strong><\/h4>\n\n\n\n

You must first activate your client application by creating an Azure Active Directory (Azure AD) application before you can access your database in SQL Database. Following that, copy the Application ID and key you’ll need to authenticate your app.<\/p>\n\n\n\n

Creating a key vault to store your keys<\/strong><\/h4>\n\n\n\n

It’s time to construct a key vault and define its access policy for accessing the vault’s secrets after creating the client app and obtaining the application ID. To generate a new column master key and set up encryption with SQL Server Management Studio, you’ll need the create, get, list, sign, verify, wrapKey, and unwrapKey permissions.<\/p>\n\n\n\n

PowerShell<\/strong><\/h6>\n\n\n\n

$subscriptionName = ‘<subscriptionName>’<\/em><\/p>\n\n\n\n

$userPrincipalName = ‘<username@domain.com>’<\/em><\/p>\n\n\n\n

$applicationId = ‘<applicationId from AAD application>’<\/em><\/p>\n\n\n\n

$resourceGroupName = ‘<resourceGroupName>’ # use the same resource group name when creating your SQL Database below<\/em><\/p>\n\n\n\n

$location = ‘<datacenterLocation>’<\/em><\/p>\n\n\n\n

$vaultName = ‘<vaultName>’<\/em><\/p>\n\n\n\n

Connect-AzAccount<\/em><\/p>\n\n\n\n

$subscriptionId = (Get-AzSubscription -SubscriptionName $subscriptionName).Id<\/em><\/p>\n\n\n\n

Set-AzContext -SubscriptionId $subscriptionId<\/em><\/p>\n\n\n\n

New-AzResourceGroup -Name $resourceGroupName -Location $location<\/em><\/p>\n\n\n\n

New-AzKeyVault -VaultName $vaultName -ResourceGroupName $resourceGroupName -Location $location<\/em><\/p>\n\n\n\n

Set-AzKeyVaultAccessPolicy -VaultName $vaultName -ResourceGroupName $resourceGroupName -PermissionsToKeys create,get,wrapKey,unwrapKey,sign,verify,list -UserPrincipalName $userPrincipalName<\/em><\/p>\n\n\n\n

Set-AzKeyVaultAccessPolicy  -VaultName $vaultName  -ResourceGroupName $resourceGroupName -ServicePrincipalName $applicationId -PermissionsToKeys get,wrapKey,unwrapKey,sign,verify,list<\/em><\/p>\n\n\n\n

Connecting with SSMS<\/strong><\/h4>\n\n\n\n

To begin, launch SQL Server Management Studio (SSMS) and connect to the server or database.<\/p>\n\n\n\n