What does Always Encrypted with Secure Enclaves in SQL Server and .NET provide?

Short answer

It keeps sensitive data encrypted in the database's memory and on disk, decrypting it only inside an authorized application server or secure processor enclave (Enclave).

Explanation

Always Encrypted protects highly sensitive data (such as credit card numbers and national IDs) even from database administrators (DBAs) and cloud server attackers. Microsoft.Data.SqlClient encrypts data in the .NET server before sending it over the network, so the database stores encrypted values. Secure Enclaves let the database perform calculations and indexing on encrypted data inside an isolated hardware enclave without exposing the original text.

Code example

// Enable transparent encryption in the connection string
"Server=...;Database=...;Column Encryption Setting=Enabled;Enclave Attestation Url=...;"

Common mistakes

• Confusing Transparent Data Encryption (TDE), which encrypts only the disk, with Always Encrypted, which encrypts data end to end.

Follow-up questions

• What is the .NET Data Protection API, and where should its keys be stored for production servers running across multiple instances?

Sources

• Microsoft Learn — Always Encrypted with secure enclaves overview