Edit

Server configuration: column encryption enclave type

Applies to: SQL Server 2019 (15.x) and later versions on Windows

This article describes how to enable or disable a secure enclave for Always Encrypted with secure enclaves. For more information, see Always Encrypted with secure enclaves and Configure the secure enclave in SQL Server.

The column encryption enclave type server configuration option controls the type of a secure enclave used for Always Encrypted. The option can be set to one of the following values:

Value Description
0 No secure enclave. The Database Engine doesn't initialize the secure enclave for Always Encrypted. As a result, the functionality of Always Encrypted with secure enclaves isn't available.
1 Virtualization based security (VBS). The Database Engine attempts to initialize a virtualization-based security (VBS) enclave.

Important

Changes to the column encryption enclave type don't take effect until you restart the SQL Server instance.

You can check the configured enclave type value and the enclave type value currently in effect by using the sys.configurations view.

To confirm an enclave of the type (greater than 0) that is currently in effect was correctly initialized after the last restart of SQL Server, check the sys.dm_column_encryption_enclave view:

For step-by-step instructions on how to configure a VBS enclave, see Step 2: Enable Always Encrypted with secure enclaves in SQL Server.

Examples

The following example enables the secure enclave and sets the enclave type to VBS:

EXECUTE sp_configure 'column encryption enclave type', 1;
GO

RECONFIGURE;
GO

The following example disables the secure enclave:

EXECUTE sp_configure 'column encryption enclave type', 0;
GO

RECONFIGURE;
GO

The following query retrieves the configured enclave type and the enclave type that is currently in effect:

USE [master];
GO

SELECT [value],
       CASE [value] WHEN 0 THEN 'No enclave' WHEN 1 THEN 'VBS' ELSE 'Other' END AS [value_description],
       [value_in_use],
       CASE [value_in_use] WHEN 0 THEN 'No enclave' WHEN 1 THEN 'VBS' ELSE 'Other' END AS [value_in_use_description]
FROM sys.configurations
WHERE [name] = 'column encryption enclave type';

Related content

  • Last updated on