CREATE CREDENTIAL sysadmin_ekm_cred WITH IDENTITY = '<VaultName>', SECRET = ‘<Secret>' FOR CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov ; The secret is the clientID appended with key without the hypen Add the credential to the SQL Server administrator's domain login ALTER LOGIN [<installation account>] ADD CREDENTIAL sysadmin_ekm_cred; GO Create Asymmetric Key CREATE ASYMMETRIC KEY CONTOSO_KEY FROM PROVIDER [AzureKeyVault_EKM_Prov] WITH PROVIDER_KEY_NAME = 'TestKey123', CREATION_DISPOSITION = OPEN_EXISTING; Enable Transparent data encryption USE master; CREATE CREDENTIAL Azure_EKM_TDE_cred WITH IDENTITY = 'testvault123', SECRET = ‘<Secret>' FOR CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov ; The secret is the clientID appended with key without the hypen USE master; -- Create a SQL Server login associated with the asymmetric key -- for the Database engine to use when it loads a database -- encrypted by TDE. CREATE TDE_Login FROM ASYMMETRIC KEY CONTOSO_KEY; GO -- Alter the TDE Login to add the credential for use by the -- Database Engine to access the key vault ALTER LOGIN TDE_Login ADD CREDENTIAL Azure_EKM_TDE_cred ; GO CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_128 ENCRYPTION BY SERVER ASYMMETRIC KEY CONTOSO_KEY; GO -- Alter the database to enable transparent data encryption. ALTER DATABASE Test
CREATE CREDENTIAL sysadmin_ekm_cred WITH IDENTITY = '<VaultName>', SECRET = ‘<Secret>' FOR CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov ; The secret is the clientID appended with key without the hypen Add the credential to the SQL Server administrator's domain login ALTER LOGIN [<installation account>] ADD CREDENTIAL sysadmin_ekm_cred; GO Create Asymmetric Key CREATE ASYMMETRIC KEY CONTOSO_KEY FROM PROVIDER [AzureKeyVault_EKM_Prov] WITH PROVIDER_KEY_NAME = 'TestKey123', CREATION_DISPOSITION = OPEN_EXISTING; Enable Transparent data encryption USE master; CREATE CREDENTIAL Azure_EKM_TDE_cred WITH IDENTITY = 'testvault123', SECRET = ‘<Secret>' FOR CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov ; The secret is the clientID appended with key without the hypen USE master; -- Create a SQL Server login associated with the asymmetric key -- for the Database engine to use when it loads a database -- encrypted by TDE. CREATE TDE_Login FROM ASYMMETRIC KEY CONTOSO_KEY; GO -- Alter the TDE Login to add the credential for use by the -- Database Engine to access the key vault ALTER LOGIN TDE_Login ADD CREDENTIAL Azure_EKM_TDE_cred ; GO CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_128 ENCRYPTION BY SERVER ASYMMETRIC KEY CONTOSO_KEY; GO -- Alter the database to enable transparent data encryption. ALTER DATABASE Test
10172016143130.docx