Control: 4.1.2 Ensure that 'Data encryption' is set to 'On' on a SQL Database


It is recommended to enable Transparent Data Encryption on every SQL database. Azure SQL database transparent data encryption helps to protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups and transaction log files at rest without requiring changes to the application.

Transparent Data Encryption (TDE) can be enabled or disabled on individual SQL Database level and not on the SQL Server level. TDE cannot be used to encrypt the logical master database in SQL Database.

Default setting for Transparent data encryption is set to On.


From Console

  1. Login to Azure console and navigate to SQL Databases.
  2. For each DB instance, go to Security section from left pane.
  3. Click on Transparent data encryption.
  4. Set Transparent data encryption to On.
  5. Click Save.

From Command Line

az sql db tde set --resource-group <resourceGroup> --server <dbServerName> -- database <dbName> --status Enabled


steampipe check azure_compliance.control.cis_v130_4_1_2


This control uses a named query: