How to resolve Databases inaccessible due to CMK TDE key access lost, configuration now correct but databases not recovering

Question

Trying to raise a support ticket but it sent me here.

1. Issue type: Technical
2. Service: SQL Database
3. Environment: Production
4. Severity: Critical (users unable to access production system)
5. Problem type: Security, Private and Compliance
6. Summary: Databases inaccessible due to CMK TDE key access lost, configuration now correct but databases not recovering

We have two Azure SQL databases stuck in an Inaccessible state due to a CMK TDE key access issue. We have verified the configuration is correct but the databases are not recovering.

Environment:

• Azure SQL Server (v12.0, Australia East)
• TDE using customer-managed key (CMK) via Azure Key Vault
• Database-level CMK configured (not server-level)
• User-assigned managed identity used for database-level TDE

What we've verified:

• Key Vault key exists, is enabled, and has not been rotated — single version only
• User-assigned managed identity has Get, List, Wrap Key, Unwrap Key permissions on the Key Vault
• User-assigned managed identity is attached to the SQL Server and set as primary identity
• System-assigned identity also has correct Key Vault permissions
• Key Vault firewall has been temporarily set to allow all networks — no change
• TDE protector set correctly at server level via CLI
• Database-level Data Encryption page shows identical configuration to a working database on the same server using the same identity and key

What we've tried:

• az sql server tde-key revalidate — succeeded but no recovery
• Database-level revalidate via REST API (/encryptionProtector/current/revalidate) — no error but no recovery
• Re-saving TDE configuration at server level via portal and CLI
• Re-attaching user-assigned managed identity via portal

Key observation: A third database on the same server (_20260306) is Online and has an identical Data Encryption configuration — same user-assigned managed identity, same key, same Key Vault. The two older databases remain Inaccessible despite matching this configuration exactly.

Question: Is there a way to force a backend recovery of the inaccessible databases given the configuration is confirmed correct? Is there a database-level operation we're missing, or does this require a Microsoft Support escalation?We have two Azure SQL databases stuck in an Inaccessible state due to a CMK TDE key access issue. We have verified the configuration is correct but the databases are not recovering.