Protecting the confidentiality and integrity of your high value data with Azure SQL and SQL Server 2

on YouTube ↗48m

" summary

Covers concrete controls: TDE with customer‑managed keys (stored in Azure Key Vault, auto‑rotation and per‑database CMKs, revoke access makes DB unavailable within ten minutes), client‑side Always Encrypted with secure enclaves (SGX hardware limited to small v‑cores and regions; VBS software enclaves in preview without attestation yet), Azure confidential VMs (AMD SEV for full VM memory encryption), and Ledger append‑only/updatable tables that hash blocks (~30s) so tampering is detectable and forensics pinpoint offending transactions.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 10:18Always Encrypted with secure enclaves
3. 13:43Secure Enclaves in Azure SQL Database
4. 30:08Confidential Virtual Machines with AMD SEV-SNP
5. 31:58Provisioning SQL Server on Azure confidential VMs
6. 37:21Leveraging Ledger in Azure SQL Database and SQL Server
7. 38:48Ledger Tables - Updatable and Append-Only

" related talks

• 40mUnderstanding the cryptographic controls in Azure SQL DatabaseMichael Howard · Microsoft Build 2023
• 32mDesigning secure Azure SQL Database solutionsMichael Howard · Microsoft Build 2023
• 43mConfidential development with Always Encrypted using enclavesPieter Vanhove · SQLBits 2024
• 51mWhere should I be encrypting my dataDenny Cherry · SQLBits 2022
• 48mGetting To Know SQL Server Encryption CapabilitiesMladen Prajdic · SQLBits 2020
• 16mSecure data processing with AMD Confidential VMs on Azure DatabricksLasse Jenzen · Microsoft Build 2024
• 45mKeeping Your AI/ML Data SecureRadu Vunvulea · Big Data Conference Europe 2022
• 22mSecuring the Future with Azure Confidential ComputingRun Cai, Ashutosh Chickerur · Confidential Computing Summit 2026