on encryption, and then you upload blobs or archived VHDs to that storage account and then turn on SSE, those blobs will not be encrypted unless they are rewritten or copied. Table, Queues, and Files data will not be encrypted Subscription-Level Protection Types Data-At-Rest Data-In-Transit Data Access IaaS Performed by the customer Performed by the customer Performed by the by encrypting the virtual by using transport customer by using native hard disk (VHD) files. encryption of traffic protections within the Microsoft and third-party traversing exposed virtual installed operating mechanisms are used. machine network system to authenticate endpoints. Microsoft and and authorize access to Workloads (such as SQL third-party mechanisms are the virtual hard disk Server) also support used. (VHD) data that is Transparent Data exposed through the Encryption (TDE). Actions performed by operating system and Microsoft include disk Technologies that assist published endpoints (for encryption using BitLocker with this are: example, operating Drive Encryption for bulk system file shares). Key Vault import/export operations SQL Server Transparent and encrypting traffic Data Encryption between Azure datacenters. Azure Disk Encryption Azure Storage Service Technologies that assist Encryption with this are: HTTPS/REST API Azure endpoints Azure Import/Export service PaaS Performed by the customer Performed by the customer Performed by the by encrypting data located by using transport customer by using shared in Queue, Table, and Blob encryption of traffic access keys and shared storage. Uses Microsoft traversing storage account access signatures to encryption mechanisms. network endpoints. provide access to data Microsoft and third-party stored in Queue, Table, Technologies that assist mechanisms are used. and Blob storage. with this are:
on encryption, and then you upload blobs or archived VHDs to that storage account and then turn on SSE, those blobs will not be encrypted unless they are rewritten or copied. Table, Queues, and Files data will not be encrypted Subscription-Level Protection Types Data-At-Rest Data-In-Transit Data Access IaaS Performed by the customer by encrypting the virtual hard disk (VHD) files. Microsoft and third-party mechanisms are used. Workloads (such as SQL Server) also support Transparent Data Encryption (TDE). Technologies that assist with this are: Key Vault SQL Server Transparent Data Encryption Azure Disk Encryption Azure Storage Service Encryption Performed by the customer by using transport encryption of traffic traversing exposed virtual machine network endpoints. Microsoft and third-party mechanisms are used. Actions performed by Microsoft include disk encryption using BitLocker Drive Encryption for bulk import/export operations and encrypting traffic between Azure datacenters. Technologies that assist with this are: HTTPS/REST API Azure endpoints Azure Import/Export service Performed by the customer by using native protections within the installed operating system to authenticate and authorize access to the virtual hard disk (VHD) data that is exposed through the operating system and published endpoints (for example, operating system file shares). PaaS Performed by the customer by encrypting data located in Queue, Table, and Blob storage. Uses Microsoft encryption mechanisms. Technologies that assist with this are: Performed by the customer by using transport encryption of traffic traversing storage account network endpoints. Microsoft and third-party mechanisms are used. Performed by the customer by using shared access keys and shared access signatures to provide access to data stored in Queue, Table, and Blob storage.
Hybrid%20Cloud%20-%20Azure%20Reference%20Architecture%20-%20Partner.docx