Retirement: Always Encrypted with Intel SGX Enclaves
Analysis / inference: Azure SQL Database is retiring Always Encrypted with Intel SGX enclaves on October 31, 2027, due to DC-series hardware phase-out.
- Published
- 06 Oct 2026, 10:12 PM IST
- Updated
- 06 Oct 2026, 10:12 PM IST
- Source
- Azure updates · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Support for Always Encrypted using Intel SGX enclaves in Azure SQL Database is ending, requiring migration to Virtualization-Based Security (VBS) enclaves or confidential VMs.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThe retirement of Intel SGX enclaves in Azure SQL Database forces database administrators and security teams to migrate dependent applications to VBS enclaves or confidential VMs before October 31, 2027.
Workloads relying on Intel SGX enclaves will lose enclave functionality after the retirement date, and connection strings as well as client drivers must be modified.
Section 03 · Recommended actions
- Migrate databases from DC-series to supported Standard-series compute tiers.
- Enable VBS enclaves for Always Encrypted.
- Update client drivers to support VBS enclaves.
- Modify connection strings to remove SGX attestation parameters and enable VBS enclave mode.
- Identify Azure SQL Databases currently running on DC-series compute tiers.
- Verify client driver versions for Always Encrypted compatibility with VBS enclaves.
- Review application connection strings for legacy SGX attestation parameters.