always-encrypted-enclaves-manage-keys.md

title	description	author	ms.author	ms.reviewer	ms.date	ms.service	ms.subservice	ms.topic	monikerRange
Manage keys for Always Encrypted with secure enclaves	Manage keys for Always Encrypted with secure enclaves	jaszymas	jaszymas	vanto	05/24/2022	sql	security	conceptual	>= sql-server-ver15

Manage keys for Always Encrypted with secure enclaves

[!INCLUDE sqlserver2019-windows-only-asdb]

Always Encrypted with secure enclaves extends key management for Always Encrypted by introducing enclave-enabled keys:

• Enclave-enabled column master key - a column master key that is created with the ENCLAVE_COMPUTATIONS property specified in the column master key metadata object inside the database.
• Enclave-enabled column encryption key - a column encryption key that is encrypted with an enclave-enabled column master key. Only enclave-enabled column encryption keys can be used for computations inside a server-side secure enclave.

The general guidelines and processes for managing Always Encrypted keys apply to managing enclave-enabled keys.

Managing keys

The following articles discuss the aspects specific to managing enclave-enabled keys.

• Provision enclave-enabled keys
• Rotate enclave-enabled keys

Next steps

• Provision enclave-enabled keys

See also

• Overview of key management for Always Encrypted
• CREATE COLUMN MASTER KEY (Transact-SQL)