Manage Always Encrypted keys

- [Instructor] So Always Encrypted makes encryption…pretty transparent to the application.…The application just needs the…Always Encrypted driver installed,…and that driver's gonna automatically encrypt and decrypt…the sensitive data in the client application…using a key that's only accessible to the driver.…It also encrypts the data before passing…the data back to the database engine,…it also automatically rewrites query so that the semantics…to the application are preserved.…So if you have a query that says select star from table…where a customer ID equals two,…it will then encrypt that two value…to pass it to the database engine.…

It also decrypts data stored in encrypted columns…that are contained in query result,…so it does it both ways.…So there's a few places we can store our keys,…and this is really important to understand.…You can use Azure Key Vault,…which we'll talk a little bit more on the next slide.…And you wanna create these keys in that trusted key store,…or you can use a custom key security provider…