10 Facts About SQL Server Transparent Data Encryption

Transparent Data Encryption known also known as TDE (learn more), encrypts SQL Server, Azure SQL Database and Azure SQL Data Warehouse data and log files on the OS-level. Moreover, a derived benefit is that also SQL Server-based backups of encrypted databases are also encrypted. This type of encryption can be characterized as encrypting data at rest. In other words, it encrypts stored data (storage can be persistent storage like a disk drive or tape).

In this article, I’m providing a list with 10 facts that you should definitely know about Transparent Data Encryption in SQL Server.

10 Facts about SQL Server Transparent Data Encryption (TDE):

  1. TDE is supported in SQL Server 2008 (Enterprise Edition only) or later, Azure SQL Database and Azure SQL Data Warehouse,
  2. When enabling TDE, you should immediately back up the certificate and the private key associated with the certificate to a safe location,
  3. Backup files of databases that have TDE enabled are also automatically encrypted by using the database encryption key,
  4. In SQL Server 2016 or later, backup compression for TDE-enabled databases is fully supported (learn more here),
  5. If  even a single database on a SQL Server instance is encrypted using TDE, then the “tempdb” system database will be automatically encrypted too,
  6. By the time a single database is encrypted using TDE, and thus tempdb is automatically encrypted, this will have a performance effect for unencrypted databases too on the same SQL Server instance.
  7. FILESTREAM data is not encrypted even when TDE is enabled,
  8. Files related to buffer pool extension (BPE) are not encrypted when a database is encrypted using TDE,
  9. In SQL Server 2016 and later, as well as in Azure SQL Database In-Memory OLTP, log records and data are encrypted if TDE is enabled. However, in SQL Server 2014 In-Memory OLTP, only log records are encrypted if TDE is enabled since files in the MEMORY_OPTIMIZED_DATA filegroup are not encrypted,
  10. When you encrypt a database in SQL Server, Azure SQL Database or Azure SQL Data Warehouse, you do not need to do anything on the application-level because as the name of TDE implies, it is totally transparent and does not require any changes on the application.


Secure your SQL Server Instances with DBA Security Advisor

DBA Security Advisor, is our SQL Server security tool, which can help you assess your SQL Server instances against a rich set of security checks. The assessment report, includes recommendations and remediation scripts that can help you better secure your SQL Server instances and databases (learn more…).

SQL Server Security Tool - DBA Security Advisor by SQLNetHub

Try DBA Security Advisor free for 7 days


Strengthen your SQL Server Administration Skills – Enroll to our Online Course!

Check our online course on Udemy titled “Essential SQL Server Administration Tips(special limited-time discount included in link).

Via the course, you will learn essential hands-on SQL Server Administration tips on SQL Server maintenance, security, performance, integration, error handling and more. Many live demonstrations and downloadable resources included!

Essential SQL Server Administration Tips - Online Course with Live Demonstrations and Hands-on Guides
(Lifetime Access/ Live Demos / Downloadable Resources and more!)

Learn More



Featured Online Courses:


Other SQL Server Security-Related Articles


Check our latest software releases!

Easily generate snippets with Snippets Generator!

Secure your databases using DBA Security Advisor!

Convert static T-SQL to dynamic and vice versa with Dynamic SQL Generator.


Rate this article: 1 Star2 Stars3 Stars4 Stars5 Stars (9 votes, average: 5.00 out of 5)


Reference: SQLNetHub.com (https://www.sqlnethub.com)

© SQLNetHub