I have a database on azure, i want to encrypt that database for which i have turned on and saved the Transparent Data Encryption Mode for my Database in the Azure portal settings . There, portal says my data is encrypted. But when I acces it through local SSMS by connecting to the Azure sql server, All the Data is Visible and accessible.

Is there any way that, even though a person has credentials despite he wouldn't be able to see the exact data in Azure Sql Database??

Please tell me if i can encrypt the whole Azure sql database which could only be decrypted by a master k

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

Exactly as Ed has said. A valid user has to be able to view the data. How else would an application be able to work if the user was unable to decrypt the data? Encryption is only helpful in the event of physical theft or if someone attempted to copy the physical files and read them somewhere else. You should follow other best practices to secure authentication to the SQL instances (firewall, least privileged users, etc).

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

• Proposed as answer by Joseph IdziorekMicrosoft employee 18 hours 5 minutes ago

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

• Proposed as answer by Joseph IdziorekMicrosoft employee 18 hours 16 minutes ago

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

• Proposed as answer by Joseph IdziorekMicrosoft employee Friday, August 28, 2015 1:03 PM

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

• Proposed as answer by Joseph IdziorekMicrosoft employee Friday, August 28, 2015 1:03 PM
• Marked as answer by Casey KarstMicrosoft employee, Moderator 15 hours 24 minutes ago

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

• Proposed as answer by Joseph IdziorekMicrosoft employee Friday, August 28, 2015 1:03 PM
• Marked as answer by Casey KarstMicrosoft employee, Moderator Wednesday, September 02, 2015 3:45 PM

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

• Proposed as answer by Joseph IdziorekMicrosoft employee Friday, August 28, 2015 1:03 PM
• Marked as answer by Casey KarstMicrosoft employee, Moderator Wednesday, September 02, 2015 3:45 PM

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

• Proposed as answer by Joseph IdziorekMicrosoft employee Friday, August 28, 2015 1:03 PM
• Marked as answer by Casey KarstMicrosoft employee, Moderator Wednesday, September 02, 2015 3:45 PM

The whole point of Transparent Data Encryption (TDE) is the transparent part. It's design so that if you have legitimate access (i.e. valid credentials) you get access. It protects against someone stealing the disks or files and reading them on other system/machine.

If they have valid credentials and valid roles in the DB, why wouldn't they be able to read the data? I'm not sure what you are trying to accomplish.

----- Ed

• Proposed as answer by Joseph IdziorekMicrosoft employee Friday, August 28, 2015 1:03 PM
• Marked as answer by Casey KarstMicrosoft employee, Moderator Wednesday, September 02, 2015 3:45 PM

Adding to what other experts mentioned:

 The TDE provides encryption of data at rest and if you are looking for encryption of data in motion, you can try - https://azure.microsoft.com/en-us/documentation/articles/sql-database-dynamic-data-masking-get-started/