Test the integration

Test the database TDE encryption

Transparent Data Encryption (TDE) protects data at rest, the .mdf, .ldf, and .bak files on disk, by encrypting database pages with a Database Encryption Key (DEK). The DEK is wrapped either by a certificate or, in an EKM/CSP Vault deployment, by an asymmetric key stored in the vault.

SQL Server only needs to unwrap the DEK when the database transitions to the online state, for example, service start, SET ONLINE, restore, or attach. After it is unwrapped, the plaintext DEK is cached in SQL Server process memory, and subsequent queries use the cached copy without contacting the vault.

To demonstrate that the database is genuinely protected by CSP, the following procedure takes the database offline, disconnects the host from the network, and attempts to bring the database back online. If the DEK is wrapped by the vault key, SQL Server cannot unwrap it and the online transition fails. Restoring network connectivity and reissuing the command returns the database to a normal state.

Before beginning the test, confirm that the vault is reachable, the database is online, and the sample data is visible.

  1. Take the database offline:

    ALTER DATABASE TestDatabase SET OFFLINE WITH ROLLBACK IMMEDIATE;

  2. Disable the network interface or block outbound traffic to the vault at the firewall.

  3. Attempt to bring the database back online:

    ALTER DATABASE TestDatabase SET ONLINE;

Msg 15466, Level 16, State 28, Line 1
An error occurred during decryption.
Msg 5181, Level 16, State 5, Line 1
Could not restart database "TestDatabase". Reverting to the previous status.
Msg 5069, Level 16, State 1, Line 1
ALTER DATABASE statement failed.

Completion time: 2026-08-12T13:47:44.3551944-04:00

  4. Re-enable the network interface.

  5. Bring the database back online:

    ALTER DATABASE TestDatabase SET ONLINE;

Commands completed successfully.

Completion time: 2026-08-12T13:49:45.5999530-04:00

Database backup and restore

For information about backing up and restoring the database, refer to Database Backup and Restore.

Remove Microsoft SQL Server TDE from the CSP Vault for Databases

For information about uninstalling the Cryptographic Security Platform Vault Policy Agent and the VM for Microsoft SQL Server TDE, refer to Removing Microsoft SQL Server TDE from the CSP Vault for Databases.