You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<Token>**THIS TOPIC APPLIES TO:**SQL Server (starting with 2014)Azure SQL DatabaseAzure SQL Data Warehouse Parallel Data Warehouse </Token>
Copy file name to clipboardExpand all lines: docs/relational-databases/security/encryption/always-encrypted-database-engine.md
+24Lines changed: 24 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -58,6 +58,30 @@ The server computes the result set, and for any encrypted columns included in th
58
58
59
59
For details of how to develop applications using Always Encrypted with particular client drivers, see [Always Encrypted (client development)](../../../relational-databases/security/encryption/always-encrypted-client-development.md).
60
60
61
+
## Remarks
62
+
63
+
Decryption occurs via the client. This means that some actions that occur only server-side will not work when using Always Encrypted.
64
+
65
+
Here's an example of an update that attempts to move data from an encrypted column to an unencrypted column without returning a result set to the client:
66
+
67
+
```sql
68
+
updatedbo.Patientsset testssn = SSN
69
+
```
70
+
71
+
If SSN is a column encrypted using Always Encryption, the above update statement will fail with an error similar to:
72
+
73
+
```
74
+
Msg 206, Level 16, State 2, Line 89
75
+
Operand type clash: char(11) encrypted with (encryption_type = 'DETERMINISTIC', encryption_algorithm_name = 'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name = 'CEK_1', column_encryption_key_database_name = 'ssn') collation_name = 'Latin1_General_BIN2' is incompatible with char
76
+
```
77
+
78
+
To successfully update the column, do the following:
79
+
80
+
1. SELECT the data out of the SSN column, and store it as a result set in the application. This will allow for the application (client) to decrypt the column.
81
+
2. INSERT/UPDATE the data from the result set in the application and send to SQL Server. Paramterization will pass the data into SQL Server via parameters so the values can be encrypted.
82
+
83
+
>[!IMPORTANT]
84
+
> In this example, the data will be unencrypted when sent back to the server because the destination column is a regular varchar that does not accept encrypted data.
61
85
62
86
## Selecting Deterministic or Randomized Encryption
63
87
The Database Engine never operates on plaintext data stored in encrypted columns, but it still supports some queries on encrypted data, depending on the encryption type for the column. Always Encrypted supports two types of encryption: randomized encryption and deterministic encryption.
Controls automatic options for [automatic tuning](../../relational-databases/automatic-tuning/automatic-tuning.md).
1486
+
Controls automatic options for [automatic tuning](../../relational-databases/automatic-tuning/automatic-tuning.md).
1487
1487
1488
-
AUTOMATIC_TUNING = { AUTO | INHERIT | CUSTOM }
1489
-
AUTO
1490
-
Setting the automatic tuning value to AUTO will apply Azure configuration defaults for automatic tuning.
1488
+
AUTOMATIC_TUNING = { AUTO | INHERIT | CUSTOM }
1489
+
AUTO
1490
+
Setting the automatic tuning value to AUTO will apply Azure configuration defaults for automatic tuning.
1491
+
1492
+
INHERIT
1493
+
Using the value INHERIT will inherit the default configuration from the parent server. This is especially useful if you would like to customize automatic tuning configuration on a parent server, and have all the databases on such server INHERIT these custom settings. Please note that in order for the inheritance to work, the three individual tuning options FORCE_LAST_GOOD_PLAN, CREATE_INDEX and DROP_INDEX need to be set to DEFAULT on databases.
1491
1494
1492
-
INHERIT
1493
-
Using the value INHERIT will inherit the default configuration from the parent server. This is especially useful if you would like to customize automatic tuning configuration on a parent server, and have all the databases on such server INHERIT these custom settings. Please note that in order for the inheritance to work, the three individual tuning options FORCE_LAST_GOOD_PLAN, CREATE_INDEX and DROP_INDEX need to be set to DEFAULT on databases.
1494
-
1495
-
CUSTOM
1496
-
Using the value CUSTOM, you will need to manually custom configure each of the automatic tuning options available on databases.
1495
+
CUSTOM
1496
+
Using the value CUSTOM, you will need to manually custom configure each of the automatic tuning options available on databases.
1497
+
1498
+
Enables or disables automatic index management `CREATE_INDEX` option of [automatic tuning](../../relational-databases/automatic-tuning/automatic-tuning.md).
1497
1499
1498
-
Enables or disables automatic index management `CREATE_INDEX` option of [automatic tuning](../../relational-databases/automatic-tuning/automatic-tuning.md).
1499
-
1500
1500
CREATE_INDEX = { DEFAULT | ON | OFF }
1501
-
DEFALT
1502
-
Inherits default settings from the server. In this case, options of enabling or disabling individual Automatic tuning features are defined at the server level.
1503
-
1504
-
ON
1501
+
DEFALT
1502
+
Inherits default settings from the server. In this case, options of enabling or disabling individual Automatic tuning features are defined at the server level.
1503
+
1504
+
ON
1505
1505
When enabled, missing indexes are automatically generated on a database. Following the index creation, gains to the performance of the workload are verified. When such created index no longer provides benefits to the workload performance, it is automatically reverted. Indexes automatically created are flagged as a system generated indexed.
1506
-
1507
-
OFF
1508
-
Does not automatically generate missing indexes on the database.
1509
-
1510
-
Enables or disables automatic index management `DROP_INDEX` option of [automatic tuning](../../relational-databases/automatic-tuning/automatic-tuning.md).
1511
-
1506
+
1507
+
OFF
1508
+
Does not automatically generate missing indexes on the database.
1509
+
1510
+
Enables or disables automatic index management `DROP_INDEX` option of [automatic tuning](../../relational-databases/automatic-tuning/automatic-tuning.md).
1511
+
1512
1512
DROP_INDEX = { DEFAULT | ON | OFF }
1513
-
DEFALT
1514
-
Inherits default settings from the server. In this case, options of enabling or disabling individual Automatic tuning features are defined at the server level.
1513
+
DEFALT
1514
+
Inherits default settings from the server. In this case, options of enabling or disabling individual Automatic tuning features are defined at the server level.
1515
1515
1516
-
ON
1517
-
Automatically drops duplicate or no longer useful indexes to the performance workload.
1516
+
ON
1517
+
Automatically drops duplicate or no longer useful indexes to the performance workload.
1518
+
1519
+
OFF
1520
+
Does not automatically drop missing inexes on the database.
1521
+
1522
+
Enables or disables automatic plan correction `FORCE_LAST_GOOD_PLAN` option of [automatic tuning](../../relational-databases/automatic-tuning/automatic-tuning.md).
1518
1523
1519
-
OFF
1520
-
Does not automatically drop missing inexes on the database.
1521
-
1522
-
Enables or disables automatic plan correction `FORCE_LAST_GOOD_PLAN` option of [automatic tuning](../../relational-databases/automatic-tuning/automatic-tuning.md).
1523
-
1524
1524
FORCE_LAST_GOOD_PLAN = { DEFAULT | ON | OFF }
1525
-
DEFAULT
1526
-
Inherits default settings from the server. In this case, options of enabling or disabling individual Automatic tuning features are defined at the server level.
1525
+
DEFAULT
1526
+
Inherits default settings from the server. In this case, options of enabling or disabling individual Automatic tuning features are defined at the server level.
1527
1527
1528
1528
ON
1529
1529
The [!INCLUDE[ssde_md](../../includes/ssde_md.md)] automatically forces the last known good plan on the [!INCLUDE[tsql_md](../../includes/tsql_md.md)] queries where new SQL plan causes performance regressions. The [!INCLUDE[ssde_md](../../includes/ssde_md.md)] continously monitors query performance of the [!INCLUDE[tsql_md](../../includes/tsql_md.md)] query with the forced plan. If there are performance gains, the [!INCLUDE[ssde_md](../../includes/ssde_md.md)] will keep using last known good plan. If performance gains are not detected, the [!INCLUDE[ssde_md](../../includes/ssde_md.md)] will produce a new SQL plan. The statement will fail if Query Store is not enabled or if it is not in *Read-Write* mode.
1530
1530
1531
1531
OFF
1532
-
The [!INCLUDE[ssde_md](../../includes/ssde_md.md)] reports potential query performance regressions caused by SQL plan changes in [sys.dm_db_tuning_recommendations](../../relational-databases/system-dynamic-management-views/sys-dm-db-tuning-recommendations-transact-sql.md) view. However, these recommendations are not automatically applied. User can monitor active recomendations and fix identified problems by applying [!INCLUDE[tsql_md](../../includes/tsql_md.md)] scripts that are shown in the view. This is the default value.
1533
-
1532
+
The [!INCLUDE[ssde_md](../../includes/ssde_md.md)] reports potential query performance regressions caused by SQL plan changes in [sys.dm_db_tuning_recommendations](../../relational-databases/system-dynamic-management-views/sys-dm-db-tuning-recommendations-transact-sql.md) view. However, these recommendations are not automatically applied. User can monitor active recomendations and fix identified problems by applying [!INCLUDE[tsql_md](../../includes/tsql_md.md)] scripts that are shown in the view. This is the default value.
1533
+
1534
1534
**\<change_tracking_option> ::=**
1535
1535
1536
1536
Controls change tracking options. You can enable change tracking, set options, change options, and disable change tracking. For examples, see the Examples section later in this article.
0 commit comments