👁 Image
Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.0

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider

👁 NuGet
👁 NuGet Downloads

Description

This library provides an Always Encrypted Azure Key Vault Provider for Microsoft.Data.SqlClient. It enables .NET applications to use Microsoft Azure Key Vault with Always Encrypted in Microsoft Azure SQL Database and Microsoft SQL Server.

Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to SQL Server. This provider enables storing column master keys (CMKs) in Azure Key Vault, providing centralized key management, secure key storage, and integration with Entra ID authentication.

Supportability

This package supports:

• .NET Framework 4.6.2+
• .NET 8.0+

Installation

Install the package via NuGet:

dotnet add package Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider

Or via the Package Manager Console:

Install-Package Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider

Getting Started

Register the Provider

Before you can use Azure Key Vault with Always Encrypted, you must register the provider globally or per-connection:

using Microsoft.Data.SqlClient;
using Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider;
using Azure.Identity;

// Create the AKV provider using Azure.Identity (recommended)
var azureCredential = new DefaultAzureCredential();
var akvProvider = new SqlColumnEncryptionAzureKeyVaultProvider(azureCredential);

// Register globally (once per application)
SqlConnection.RegisterColumnEncryptionKeyStoreProviders(
 new Dictionary<string, SqlColumnEncryptionKeyStoreProvider>
 {
 { SqlColumnEncryptionAzureKeyVaultProvider.ProviderName, akvProvider }
 });

Use with a Connection

Enable Always Encrypted in your connection string:

var connectionString = "Server=myserver;Database=mydb;Column Encryption Setting=Enabled;...";

using var connection = new SqlConnection(connectionString);
await connection.OpenAsync();

// Execute queries against encrypted columns - encryption/decryption is automatic
using var command = new SqlCommand("SELECT SSN FROM Customers WHERE Id = @id", connection);
command.Parameters.AddWithValue("@id", customerId);
var ssn = await command.ExecuteScalarAsync();

Key Features

• Azure Key Vault Integration: Store and manage column master keys (CMKs) in Azure Key Vault
• Entra ID Authentication: Supports Azure.Identity credentials for seamless Entra ID authentication
• Key Caching: Built-in caching of column encryption keys (CEKs) for improved performance
• Multiple Authentication Methods: Supports DefaultAzureCredential, ClientSecretCredential, ManagedIdentityCredential, and more

Documentation

• Always Encrypted Overview
• Configure Always Encrypted with Azure Key Vault
• Microsoft.Data.SqlClient Documentation
• Azure Key Vault Documentation

Release Notes

Release notes are available at: https://go.microsoft.com/fwlink/?linkid=2090501

License

This package is licensed under the MIT License.

Related Packages

• Microsoft.Data.SqlClient - The main SqlClient driver
• Azure.Identity - Entra ID authentication library
• Azure.Security.KeyVault.Keys - Azure Key Vault Keys client library