You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/relational-databases/security/encryption/always-encrypted-query-columns-ssms.md
+8-9Lines changed: 8 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,14 +2,13 @@
2
2
title: "Query columns using Always Encrypted with SQL Server Management Studio | Microsoft Docs"
3
3
description: Learn how to query columns in Always Encrypted using SQL Server Management Studio. Retrieve ciphertext or text values stored in encrypted columns.
@@ -35,7 +34,7 @@ Running SELECT queries that retrieve ciphertext of data stored in encrypted colu
35
34
### Example
36
35
Assuming `SSN` is an encrypted column in the `Patients` table, the query shown below will retrieve binary ciphertext values, if Always Encrypted is disabled for the database connection.
37
36
38
-
![Screenshot of the SELECT [SSN] FROM [dbo].[Patients] query and the results of the query shown as binary ciphertext values.](../../../relational-databases/security/encryption/media/always-encrypted-ciphertext.png)
37
+
:::image type="content" source="../../../relational-databases/security/encryption/media/always-encrypted-ciphertext.png" alt-text="Screenshot of the SELECT [SSN] FROM [dbo].[Patients] query and the results of the query shown as binary ciphertext values." lightbox="../../../relational-databases/security/encryption/media/always-encrypted-ciphertext.png":::
39
38
40
39
## Retrieving plaintext values stored in encrypted columns
41
40
To retrieve values from an encrypted column as plaintext (to decrypt the values):
@@ -46,7 +45,7 @@ To retrieve values from an encrypted column as plaintext (to decrypt the values)
46
45
### Example
47
46
Assuming SSN is an encrypted `char(11)` column in the `Patients` table, the query, shown below, will return plaintext values, if Always Encrypted is enabled for the database connection and if you have access to the column master key configured for the `SSN` column.
48
47
49
-
![Screenshot of the SELECT [SSN] FROM [Clinic].[dbo].[Patients] query and the results of the query shown as plain text values.](../../../relational-databases/security/encryption/media/always-encrypted-plaintext.png)
48
+
:::image type="content" source="../../../relational-databases/security/encryption/media/always-encrypted-plaintext.png" alt-text="Screenshot of the SELECT [SSN] FROM [Clinic].[dbo].[Patients] query and the results of the query shown as plain text values." lightbox="../../../relational-databases/security/encryption/media/always-encrypted-plaintext.png":::
To execute a query that sends a value that targets an encrypted column, for example a query that inserts, updates or filters by a value stored in an encrypted column:
@@ -60,7 +59,7 @@ To execute a query that sends a value that targets an encrypted column, for exam
60
59
### Example
61
60
Assuming `SSN` is an encrypted `char(11)` column in the `Patients` table, the below script will attempt to find a row containing `'795-73-9838'` in the SSN column and return the value of the `LastName` column, providing Always Encrypted is enabled for the database connection, Parameterization for Always Encrypted is enabled for the Query Editor window, and you have access to the column master key configured for the `SSN` column.
62
61
63
-
![Screenshot of the DECLARE @SSN CHAR(11) = '795-73-9838' SELECT [LastName] FROM [dbo].[Patients] WHERE [SSN] = @SSNquery and the results of the query.](../../../relational-databases/security/encryption/media/always-encrypted-patients.png)
62
+
:::image type="content" source="../../../relational-databases/security/encryption/media/always-encrypted-patients.png" alt-text="Screenshot of the query using a variable for @SSN and the resulting row returned." lightbox="../../../relational-databases/security/encryption/media/always-encrypted-patients.png":::
64
63
65
64
## Permissions for querying encrypted columns
66
65
@@ -180,11 +179,11 @@ If SQL Server Management Studio has attempted to parameterize a variable, but th
180
179
181
180
The below screenshot shows an example of six variable declarations. SQL Server Management Studio successfully parameterized the first three variables. The last three variables didn't meet the pre-requisite conditions for parameterization, and therefore, SQL Server Management Studio didn't attempt to parameterize them (their declarations aren't marked in any way).
182
181
183
-

184
-
182
+
:::image type="content" source="../../../relational-databases/security/encryption/media/always-encrypted-parameter-warnings.png" alt-text="Screenshot showing an example of six variable declarations with three successfully parameterized and three failures and the associated warning messages." lightbox="../../../relational-databases/security/encryption/media/always-encrypted-parameter-warnings.png":::
183
+
185
184
Another example below, shows two variables that meet pre-requisite conditions for parameterization, but the parameterization attempt has failed because the variables are incorrectly initialized.
186
185
187
-

186
+
:::image type="content" source="../../../relational-databases/security/encryption/media/always-encrypted-error.png" alt-text="Screenshot showing an example of two variable declarations that ultimately fail with the associated error messages." lightbox="../../../relational-databases/security/encryption/media/always-encrypted-error.png":::
188
187
189
188
> [!NOTE]
190
189
> As Always Encrypted supports a limited subset of type conversions, in many cases it is required that the data type of a Transact-SQL variable is the same as the type of the target database column, it targets. For example, assuming type of the `SSN` column in the `Patients` table is `char(11)`, the below query will fail, as the type of the `@SSN` variable, which is `nchar(11)`, does not match the type of the column.
@@ -213,4 +212,4 @@ column_encryption_key_database_name = 'Clinic') are incompatible in the equal to
0 commit comments