Restore TDS enabled Managed instance database to on premise sql server

Question

Restore TDS enabled Managed instance database to on premise sql server

SethuRam 66

I have a Azure Managed instance database with TDE enabled (customer managed keys) , i need to take copy_only .bak backup for this MI database to azure blob storage using SAS URL(I achieved this by creating certificate and running Tsql query) . Now my use case is i need to move this backup file to on premise and restore it , is this even a viable option? I dont want to use dacpac/backpac export it has to be .bak restore process

Should the on premise sql server needs to be TDE enabled?
Do i need to export the azure managed instance database Customer managed key to on prem?

KalyanChanumolu-MSFT 8,351 Reputation points

2021-08-27T10:44:55.52+00:00

@SethuRam Thank you for reaching out.

Is your Customer Managed Key generated by the KeyVault or did you import a certificate?
You mentioned, copy only backup was generated by creating a certificate. Could you please elaborate on the process you followed?
SethuRam 66 Reputation points

2021-08-27T12:36:52.39+00:00

Hi kalyan,
I have taken the copy only backup by disabling the TDE and used a SAS certificate to place the backup file on Azure blob storage. I wanted to see without disabling TDE , can I generate a key in key vault and use that as a customer managed key and do the same processs?

My main question is , is it even feasible option to restore a .bak backup file (encrypted) on on-premise sql server ?

1 answer

Your answer

KalyanChanumolu-MSFT 8,351 Reputation points

2021-08-27T10:44:55.52+00:00

@SethuRam Thank you for reaching out.

Is your Customer Managed Key generated by the KeyVault or did you import a certificate?
You mentioned, copy only backup was generated by creating a certificate. Could you please elaborate on the process you followed?
SethuRam 66 Reputation points

2021-08-27T12:36:52.39+00:00

Hi kalyan,
I have taken the copy only backup by disabling the TDE and used a SAS certificate to place the backup file on Azure blob storage. I wanted to see without disabling TDE , can I generate a key in key vault and use that as a customer managed key and do the same processs?

My main question is , is it even feasible option to restore a .bak backup file (encrypted) on on-premise sql server ?

Answer 1

KalyanChanumolu-MSFT 8,351

@SethuRam Thank you for providing more context.

If you cannot use a bacpac and must use a .bak file to restore the database, I would recommend disabling TDE and then taking a backup from MI.
You can then configure TDE on your on-premises SQL Server separately.

----------

If an answer is helpful, please "Accept answer" or "Up-Vote" which might help other community members reading this thread.
And if you have further questions or issues, please let us know.

Johannes Maly 101 Reputation points

2025-04-01T08:52:28.28+00:00

Disabling TDE on a huge database can be quite time consuming. And in my opinion disabling TDE is not a good idea. Because then data is backuped in an unprotected manner.

Share via

Restore TDS enabled Managed instance database to on premise sql server

1 answer

Your answer