# Ensure that 'Data encryption' is set to 'On' on a SQL Database

- Source: https://support.icompaas.com/support/solutions/articles/62000219826-ensure-that-data-encryption-is-set-to-on-on-a-sql-database
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [4. Database Services](https://support.icompaas.com/support/solutions/folders/62000167547)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Azure SQL Database uses Transparent Data Encryption (TDE) to protect data at rest by automatically encrypting the database, backups, and transaction logs. Ensuring that Data Encryption is set to ‘On’ guarantees that the database is protected against unauthorised access to the underlying storage.

  

Rationale:

Enabling Transparent Data Encryption (TDE) ensures that data stored in SQL databases is protected by encrypting it at rest. This prevents unauthorised offline access to database files and reduces the risk of data theft if the underlying storage is compromised. TDE also ensures that backups and logs are automatically encrypted, supporting regulatory compliance requirements such as PCI-DSS, HIPAA, and ISO.

  

Impact:

When TDE is enabled, the SQL database, backups, and logs are automatically encrypted with minimal performance impact. Encryption occurs transparently without requiring application changes and significantly reduces the risk of data theft.

  

Default Value:

-   Enabled (On) by default for Azure SQL Database
    
-   Can be manually disabled (not recommended)
    
-   Uses Microsoft-managed keys unless customer-managed keys (CMK) are configured
    

Pre-requisites:

-   At least one Azure SQL Database or Managed Instance
    
-   Appropriate permissions: Contributor, SQL Security Manager, or Owner  
      
    

Test Plan:

1.  Log in to the Azure Portal: [https://portal.azure.com](https://portal.azure.com/)
    
2.  In the search bar, type SQL databases. Select the SQL Database you want to evaluate.
    
3.  Under the Security section, click Data encryption.
    
4.  Under the Transparent Data Encryption option, check that the Data Encryption (TDE) status is encrypted.
    
5.  Verify that the Data Encryption field is set to On. If it is off, follow the implementation Steps.
    

![](https://support.icompaas.com/assets/kb/389434db279bee56.png)  
  

Implementation Steps:

1.  Log in to the Azure Portal: [https://portal.azure.com](https://portal.azure.com/)
    
2.  In the search bar, type SQL databases. Select the SQL Database you want to evaluate.
    

![](https://support.icompaas.com/assets/kb/227937cd0b138c62.png)

3.  Under the Security section, click Data encryption.
    

                                       ![](https://support.icompaas.com/assets/kb/a8702561659147a4.png)

4.  Switch Data Encryption toggle from Off to On.
    

![](https://support.icompaas.com/assets/kb/69aa423ee9541e19.png)

5.  If using customer-managed keys (optional), configure Key Vault integration.
    
6.  Click Save to apply the configuration.
    
7.  Confirm that the encryption status changes to “Encrypted”.  
      
    

Backout Plan:

1.  Log in to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the search bar, type SQL databases and open the resource list.
    
3.  Select the SQL database you want to modify.
    
4.  Under the Security section, go to Data encryption and open the Transparent Data Encryption settings.
    
5.  Switch the Data Encryption (TDE) toggle from On to Off.
    
6.  Click Save.
    
7.  Confirm that the encryption status changes to “Not Encrypted.”
    

Reference:

-   [https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview](https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.