question

surya1509 avatar image
0 Votes"
surya1509 asked AnuragSharma-MSFT commented

Azure TDE enabled MI with custom keys cross subscription backup and restore

Hi,
I have a Azure MI with TDE custom key enabled integrated with key vault on subcription "abc"(consider this as production environment). I have a use case to take a COPYONLY backup(.bak) to azure blog storage and use this backup and restore it to another Azure MI with TDE enabled (which is on different subscription "xyz").
Is it possible in TDE enabled azure MI to do backup and restore across another subscription Azure MI (with TDE enabled)? using custom managed keys ? if you could you please let me know the steps involved?

azure-sql-database
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @surya1509, just wanted to follow up on this thread if you need any other details. If answer helped, you can mark it 'Accept Answer'

0 Votes 0 ·

1 Answer

AnuragSharma-MSFT avatar image
0 Votes"
AnuragSharma-MSFT answered

Hi @surya1509, welcome to Microsoft Q&A forum.

As per the article, "In Azure SQL Managed Instance copy-only backup cannot be created for a database encrypted with service-managed Transparent Data Encryption (TDE). Service-managed TDE uses internal key for encryption of data, and that key cannot be exported, so you could not restore the backup anywhere else. Consider using customer-managed TDE instead to be able to create copy-only backups of encrypted databases, but make sure to have encryption key available for later restore."

So firstly we need to use the Customer-managed TDE if we want to take copy-only backup and then we can restore it across subscription as mentioned in the below articles:

Copy-Only Backups - Please note this article explains the process of creating the backup in the local system. However we can use command like below to restore it on Azure Blob Storage:

  USE [master]
    
 BACKUP DATABASE [SQLTestDB] 
 TO  URL = N'https://msftutorialstorage.blob.core.windows.net/sql-backup/sqltestdb_backup_2020_01_01_000001.bak' 
 WITH  COPY_ONLY, CHECKSUM
 GO

I have not tried this command myself but you can refer to SQL backup and restore to Azure Blob storage service

Restore a database to Azure SQL Managed Instance with SSMS

Please let me know if this helps or else we can discuss further on the same.


Please don't forgot to click on accept it as answer button 134683-image.png wherever the information provided helps you. This can be beneficial to other community members as well.



image.png (7.4 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.