The AZ-500 exam has been retired
It was retired on August 31, 2026. It was replaced by SC-500 (Microsoft Cloud and AI Security Engineer). Go to the SC-500 study guide →
4.3.4. Transparent Data Encryption (TDE) and Always Encrypted
💡 First Principle: Encryption protects data at rest. TDE encrypts the entire database transparently; Always Encrypted encrypts specific columns with keys never exposed to the database server.
Encryption Comparison
| Feature | TDE | Always Encrypted |
|---|---|---|
| Scope | Entire database | Specific columns |
| Key Location | Database server | Client only |
| Protected From | Storage theft | Storage theft + DBA access |
| Query Support | Full | Limited (deterministic only) |
| Use Case | General encryption | Highly sensitive columns |
Scenario: You need to ensure certain columns cannot be decrypted by database administrators.
Answer: Use Always Encrypted. TDE protects data at rest but DBAs with access to the database can read decrypted data. Always Encrypted keeps keys on the client side—the database server never sees plaintext.
⚠️ Exam Trap: Thinking TDE protects against DBAs. TDE encrypts data files on disk but decryption is transparent to authorized database users. For protection against privileged database access, use Always Encrypted.
Always Encrypted Supported Operations
- Supported: Point lookups, equality comparisons (deterministic encryption)
- Not Supported: Range queries, LIKE operations, copying between columns
