SQL database has Transparent Data Encryption (TDE) enabled

Check ID: sqlserver_tde_encryption_enabled
Provider: Azure
Service: sqlserver
Severity: HIGH
Categories: encryption
Resource type: microsoft.sql/servers/databases

What this check verifies

Azure SQL user databases have Transparent Data Encryption (TDE) enabled, ensuring encryption of database files, backups, and transaction logs at rest. The master system database is excluded from evaluation.

Risk

Without TDE, data at rest remains unencrypted:

Stolen backups, snapshots, or compromised storage enable offline data disclosure
Attackers with substrate access can bypass DB auth, harming confidentiality and enabling exfiltration

Recommendation

Enable TDE on all Azure SQL user databases. Prefer customer-managed keys in Key Vault or Managed HSM for control, rotation, and revocation. Apply least privilege and separation of duties to key access, enforce via policy, and monitor key/audit logs. Maintain key backups and lifecycle to prevent availability loss.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az sql db tde set —resource-group <RESOURCE_GROUP> —server <SERVER_NAME> —database <DATABASE_NAME> —status Enabled

resource "azurerm_mssql_database" "<example_resource_name>" {
  name      = "<example_resource_name>"
  server_id = "<example_resource_id>"

  transparent_data_encryption_enabled = true # critical: enables TDE
}

// Enable TDE on an existing Azure SQL Database
resource tde 'Microsoft.Sql/servers/databases/transparentDataEncryption@2021-11-01' = {
  name: '<example_server_name>/<example_database_name>/current'
  properties: {
    state: 'Enabled' // critical: enables Transparent Data Encryption (TDE)
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = sqlserver_tde_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

SQL Server TDE uses a customer-managed key Azure SQL Server has no unrestricted firewall rule

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires