| Plugin Title | TDE Protector Encrypted |
| Cloud | AZURE |
| Category | SQL Server |
| Description | Ensures SQL Server TDE protector is encrypted with BYOK (Bring Your Own Key) |
| More Info | Enabling BYOK in the TDE protector allows for greater control and transparency, as well as increasing security by having full control of the encryption keys. |
| AZURE Link | https://docs.microsoft.com/en-us/azure/sql-database/transparent-data-encryption-byok-azure-sql |
| Recommended Action | Ensure that a BYOK key is set for the Transparent Data Encryption of each SQL Server. |
- Log into the Microsoft Azure Management Console.
- Select the "Search resources, services, and docs" option at the top and search for SQL servers.
- On the "SQL server" page, select the SQL server that needs to be examine.
- On the selected "SQL server" page, scroll down the left navigation panel and select "Transparent data encryption" under the "Security" column.
- On the "Transparent data encryption" page, if "Use your own key" is set to "NO" then the selected "SQL server TDE protector" is not encrypted with BYOK (Bring Your Own Key).
- Repeat steps number 2 - 5 to verify other "SQL servers" in the account.
- Navigate to "SQL servers", on the "SQL servers" page select the "SQL server", scroll down the left navigation panel and choose "Transparent data encryption" under the "Security."
- On the "Transparent data encryption" page, click on the "Yes" button next to the "Use your own key". Select the "Key vault" and "Key" accordingly. Click on the checkbox next to "Make the selected key the default TDE protector."
- Click on the "Save" button at the top to make the changes.
- Reepat steps number 7 - 9 to ensure that a BYOK key is set for the Transparent Data Encryption of each SQL Server.
