Edit

Configure the enclave type for Always Encrypted (server configuration option)

  • Article

Applies to: SQL Server 2019 (15.x) and later - Windows only

This article describes how to enable or disable a secure enclave for Always Encrypted with secure enclaves. For more information, see Always Encrypted with secure enclaves and Configure the secure enclave in SQL Server.

The column encryption enclave type Server Configuration Option controls the type of a secure enclave used for Always Encrypted. The option can be set to one of the following values:

Value Description
0 No secure enclave. The Database Engine will not initialize the secure enclave for Always Encrypted. As a result, the functionality of Always Encrypted with secure enclaves will not be available.
1 Virtualization based security (VBS). The Database Engine will attempt to initialize a virtualization-based security (VBS) enclave.

Important

Changes to the column encryption enclave type do not take effect until you restart the SQL Server instance.

You can check the configured enclave type value and the enclave type value currently in effect by using the sys.configurations (Transact-SQL) view.

To confirm an enclave of the type (greater than 0) that is currently in effect has been correctly initialized after the last restart of SQL Server, check the sys.dm_column_encryption_enclave (Transact-SQL) view:

For step-by-step instructions on how to configure a VBS enclave, see Step 2: Enable Always Encrypted with secure enclaves in SQL Server.

Examples

The following example enables the secure enclave and sets the enclave type to VBS:

sp_configure 'column encryption enclave type', 1;  
GO  
RECONFIGURE;  
GO

The following example disables the secure enclave:

sp_configure 'column encryption enclave type', 0;  
GO  
RECONFIGURE;  
GO

The following query retrieves the configured enclave type and the enclave type that is currently in effect:

USE [master];
GO
SELECT
[value]
, CASE [value] WHEN 0 THEN 'No enclave' WHEN 1 THEN 'VBS' ELSE 'Other' END AS [value_description]
, [value_in_use]
, CASE [value_in_use] WHEN 0 THEN 'No enclave' WHEN 1 THEN 'VBS' ELSE 'Other' END AS [value_in_use_description]
FROM sys.configurations
WHERE [name] = 'column encryption enclave type';

Next Steps

Manage keys for Always Encrypted with secure enclaves

See Also

Server Configuration Options (SQL Server)
sp_configure (Transact-SQL)
RECONFIGURE (Transact-SQL)
sys.configurations (Transact-SQL)
sys.dm_column_encryption_enclave (Transact-SQL)