10 Facts About SQL Server Transparent Data Encryption

10 Facts About SQL Server Transparent Data Encryption

10 Facts About SQL Server Transparent Data Encryption

Transparent Data Encryption known also known as TDE (learn more), encrypts SQL Server, Azure SQL Database and Azure SQL Data Warehouse data and log files on the OS-level. Moreover, a derived benefit is that also SQL Server-based backups of encrypted databases are also encrypted. This type of encryption can be characterized as encrypting data at rest. In other words, it encrypts stored data (storage can be persistent storage like a disk drive or tape).

In this article, I’m providing a list with 10 facts that you should definitely know about Transparent Data Encryption in SQL Server.

10 Facts about SQL Server Transparent Data Encryption (TDE):

  1. TDE is supported in SQL Server 2008 (Enterprise Edition only) or later, Azure SQL Database and Azure SQL Data Warehouse,
  2. When enabling TDE, you should immediately back up the certificate and the private key associated with the certificate to a safe location,
  3. Backup files of databases that have TDE enabled are also automatically encrypted by using the database encryption key,
  4. In SQL Server 2016 or later, backup compression for TDE-enabled databases is fully supported (learn more here),
  5. If  even a single database on a SQL Server instance is encrypted using TDE, then the “tempdb” system database will be automatically encrypted too,
  6. By the time a single database is encrypted using TDE, and thus tempdb is automatically encrypted, this will have a performance effect for unencrypted databases too on the same SQL Server instance.
  7. FILESTREAM data is not encrypted even when TDE is enabled,
  8. Files related to buffer pool extension (BPE) are not encrypted when a database is encrypted using TDE,
  9. In SQL Server 2016 and later, as well as in Azure SQL Database In-Memory OLTP, log records and data are encrypted if TDE is enabled. However, in SQL Server 2014 In-Memory OLTP, only log records are encrypted if TDE is enabled since files in the MEMORY_OPTIMIZED_DATA filegroup are not encrypted,
  10. When you encrypt a database in SQL Server, Azure SQL Database or Azure SQL Data Warehouse, you do not need to do anything on the application-level because as the name of TDE implies, it is totally transparent and does not require any changes on the application.


Secure your SQL Server Instances with DBA Security Advisor

DBA Security Advisor, is our SQL Server security tool, which can help you assess your SQL Server instances against a rich set of security checks. The assessment report, includes recommendations and remediation scripts that can help you better secure your SQL Server instances and databases (learn more…).

SQL Server Security Tool - DBA Security Advisor by SQLNetHub

Try DBA Security Advisor free for 30 days!


Other SQL Server Security-Related Articles


Check our latest software releases!

Easily generate snippets with Snippets Generator!

Secure your databases using DBA Security Advisor!

Convert static T-SQL to dynamic and vice versa with Dynamic SQL Generator.


Rate this article: 1 Star2 Stars3 Stars4 Stars5 Stars (8 votes, average: 5.00 out of 5)


Reference: SQLNetHub.com (https://www.sqlnethub.com)

© SQLNetHub


Artemakis Artemiou
Artemakis Artemiou is a Senior SQL Server Architect, Author, and a 9 Times Microsoft Data Platform MVP (2009-2018). He has over 15 years of experience in the IT industry in various roles. Artemakis is the founder of SQLNetHub and TechHowTos.com. Artemakis is the creator of the well-known software tools Snippets Generator and DBA Security Advisor. Also, he is the author of many eBooks on SQL Server. Artemakis currently serves as the President of the Cyprus .NET User Group (CDNUG) and the International .NET Association Country Leader for Cyprus (INETA). Artemakis's official website can be found at aartemiou.com.