Back to Checks
azure

SQL database has Transparent Data Encryption (TDE) enabled

sqlserver_tde_encryption_enabled
Service: sqlserverSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.sql/servers/databases

Azure SQL user databases have Transparent Data Encryption (TDE) enabled, ensuring encryption of database files, backups, and transaction logs at rest.

The master system database is excluded from evaluation.

Prowler logoProwlerprowler-provider-azure

Risk

Without TDE, data at rest remains unencrypted:

  • Stolen backups, snapshots, or compromised storage enable offline data disclosure
  • Attackers with substrate access can bypass DB auth, harming confidentiality and enabling exfiltration

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks sqlserver_tde_encryption_enabled

Recommendation

Enable TDE on all Azure SQL user databases. Prefer customer-managed keys in Key Vault or Managed HSM for control, rotation, and revocation. Apply least privilege and separation of duties to key access, enforce via policy, and monitor key/audit logs. Maintain key backups and lifecycle to prevent availability loss.

Remediation

CLI

az sql db tde set --resource-group <RESOURCE_GROUP> --server <SERVER_NAME> --database <DATABASE_NAME> --status Enabled

Terraform

resource "azurerm_mssql_database" "<example_resource_name>" {
  name      = "<example_resource_name>"
  server_id = "<example_resource_id>"

  transparent_data_encryption_enabled = true # critical: enables TDE
}

NativeIaC

// Enable TDE on an existing Azure SQL Database
resource tde 'Microsoft.Sql/servers/databases/transparentDataEncryption@2021-11-01' = {
  name: '<example_server_name>/<example_database_name>/current'
  properties: {
    state: 'Enabled' // critical: enables Transparent Data Encryption (TDE)
  }
}

Other

1In Azure Portal, go to SQL databases and select the target database (not master)
2Under Settings, open Transparent data encryption
3Set Transparent data encryption to On (Enabled) and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.sqlserver.sqlserver_client import sqlserver_client


class sqlserver_tde_encryption_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, sql_servers in sqlserver_client.sql_servers.items():
            subscription_name = sqlserver_client.subscriptions.get(
                subscription, subscription
            )
            for sql_server in sql_servers:
                databases = (
                    sql_server.databases if sql_server.databases is not None else []
                )
                if len(databases) > 0:
                    for database in databases:
                        if database.name.lower() == "master":
                            continue
                        report = Check_Report_Azure(
                            metadata=self.metadata(), resource=database
                        )
                        report.subscription = subscription
                        if database.tde_encryption.status == "Enabled":
                            report.status = "PASS"
                            report.status_extended = f"Database {database.name} from SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has TDE enabled"
                        else:
                            report.status = "FAIL"
                            report.status_extended = f"Database {database.name} from SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has TDE disabled"
                        findings.append(report)

        return findings

References