Export Azure DB (but disable encryption)

Question

Hi

I know this sounds like a bad idea, but I have a legit reason for this. BUT.... all our DBs have TDE enabled but I'd like to be able to perform a couple of backups without encryption being enabled. Beyond enabling/disabling TDE via the portal for this process... is there already some tooling/API that can enable this? (specifically backup-without-encryption as opposed to disable TDE, backup , enable TDE)

I can't find anything and am working through an automated process to restore to SQL Server, backup from there. But would prefer going directly from Azure.

Thoughts?

Thanks

Ken

Answer 1

Hi @KenFaulkner-6543 - There is currently no means to disable encryption for a specific export to bacpac operation. I looked at PowerShell, SqlPackage.exe, and other export options as per: Export to a BACPAC file - Azure SQL Database and Azure SQL Managed Instance

I did want to make you aware of the following points though, from Move a transparent data encryption-protected database:

• When you export a TDE-protected database, the exported content of the database isn't encrypted. This exported content is stored in unencrypted BACPAC files. Be sure to protect the BACPAC files appropriately and enable TDE after import of the new database is finished.
• For example, if the BACPAC file is exported from a SQL Server instance, the imported content of the new database isn't automatically encrypted. Likewise, if the BACPAC file is imported to a SQL Server instance, the new database also isn't automatically encrypted.
• The one exception is when you export a database to and from SQL Database. TDE is enabled on the new database, but the BACPAC file itself still isn't encrypted.

Please let us know if there are additional questions.

Regards,
Mike