You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/connect/odbc/using-always-encrypted-with-the-odbc-driver.md
+10-1Lines changed: 10 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -391,13 +391,16 @@ The driver supports authenticating to Azure Key Vault using the following creden
391
391
392
392
- Managed Identity (17.5.2+) - either system or user-assigned; see [Managed Identities for Azure resources](/azure/active-directory/managed-identities-azure-resources/) for more information.
393
393
394
+
- Azure Key Vault Interactive - with this method, the credentials are authenticated through Azure Active Directory with Login ID.
395
+
394
396
To allow the driver to use CMKs stored in AKV for column encryption, use the following connection-string-only keywords:
@@ -427,6 +430,12 @@ DRIVER=ODBC Driver 17 for SQL Server;SERVER=myServer;Trusted_Connection=Yes;DATA
427
430
DRIVER=ODBC Driver 17 for SQL Server;SERVER=myServer;Trusted_Connection=Yes;DATABASE=myDB;ColumnEncryption=Enabled;KeyStoreAuthentication=KeyVaultManagedIdentity;KeyStorePrincipalId=<objectID>
428
431
```
429
432
433
+
**AKV Interactive**
434
+
435
+
```
436
+
DRIVER=ODBC Driver 17 for SQL Server;SERVER=myServer;Trusted_Connection=Yes;DATABASE=myDB;ColumnEncryption=Enabled;KeyStoreAuthentication=KeyVaultInteractive;UID=<userID>;PWD=<password>
437
+
```
438
+
430
439
No other ODBC application changes are required to use AKV for CMK storage.
431
440
432
441
> [!NOTE]
@@ -614,7 +623,7 @@ See [Migrate Sensitive Data Protected by Always Encrypted](../../relational-data
614
623
|Name|Description|
615
624
|----------|-----------------|
616
625
|`ColumnEncryption`|Accepted values are `Enabled`/`Disabled`.<br>`Enabled` -- enables Always Encrypted functionality for the connection.<br>`Disabled` -- disable Always Encrypted functionality for the connection.<br>*type*,*data* -- (version 17.4 and later) enables Always Encrypted with secure enclave and attestation protocol *type*, and associated attestation data *data*. <br><br>The default is `Disabled`.|
|`KeyStorePrincipalId`| When `KeyStoreAuthentication` = `KeyVaultPassword`, set this value to a valid Azure Active Directory User Principal Name. <br>When `KeyStoreAuthetication` = `KeyVaultClientSecret` set this value to a valid Azure Active Directory Application Client ID |
619
628
|`KeyStoreSecret`| When `KeyStoreAuthentication` = `KeyVaultPassword` set this value to the password for the corresponding user name. <br>When `KeyStoreAuthentication` = `KeyVaultClientSecret` set this value to the Application Secret associated with a valid Azure Active Directory Application Client ID |
0 commit comments