Azure SQL Managed Instance Series - Configuring Azure Managed Instance TDE with Customer Managed Key

Azure SQL Managed Instance Series -
Configuring Azure SQL Managed Instance Transparent Data Encryption (TDE) with Customer Managed Key ‪@jbswiki‬ #sqlmi #managedinstance

If you're using Azure SQL Managed Instance, you may want to configure Transparent Data Encryption (TDE) with a customer-managed key instead of the default service-managed key. This allows you to have more control over the encryption process and ensures that your data is always secure. However, configuring TDE with a customer-managed key can sometimes lead to backup and restore errors. In this video, we will explore how to configure Azure SQL Managed Instance TDE with a customer-managed key and how to backup and restore databases without encountering errors.

Part 1: Configuring Azure SQL Managed Instance TDE with Customer Managed Key

Azure SQL Managed Instance uses a default service-managed key to encrypt data at rest. However, you can use a customer-managed key instead, which gives you more control over the encryption process. To configure Azure SQL Managed Instance TDE with a customer-managed key, you will need to follow a few steps. We won't go through the exact steps in this video, but we'll give you an overview of the process.

Part 2: Solving Backup and Restore Errors

When using a service-managed key, you may encounter errors when attempting to backup and restore databases. This is because the backup operation is not supported on SQL Database Managed Instance when using a service-managed transparent data encryption. To solve this error, you will need to copy the certificate and key to the destination instance, create a database master key, create a certificate, and backup and restore the database. Again, we won't go through the exact steps in this video, but we'll give you an overview of the process.

Conclusion:

Configuring Azure SQL Managed Instance TDE with a customer-managed key gives you more control over the encryption process and ensures that your data is always secure. However, it can sometimes lead to backup and restore errors. By following the steps we've outlined in this video, you can configure Azure SQL Managed Instance TDE with a customer-managed key and backup and restore databases without encountering errors.

BACKUP DATABASE failed. SQL Database Managed Instance supports only COPY_ONLY full database backups which are initiated by user.

Msg 41922, Level 16, State 1, Line 6
The backup operation for a database with service-managed transparent data encryption is not supported on SQL Database Managed Instance.
Msg 3013, Level 16, State 1, Line 6
BACKUP DATABASE is terminating abnormally.