Always Encrypted
← Back to DP-420 Terminology Reference
Category: Maintenance & Security
Summary: Client-side encryption ensuring Cosmos DB never sees plaintext values of protected properties.
Overview
Always Encrypted for Azure Cosmos DB is a client-side encryption feature that encrypts sensitive data (specific properties) before it leaves the client application, ensuring that even Azure Cosmos DB itself never sees the plaintext values. Encryption and decryption happen using keys managed by the client, typically backed by Azure Key Vault, providing strong protection for highly sensitive fields.
More Info & Links
DP-420 Style Practice Questions
Q1. What does Always Encrypted for Azure Cosmos DB protect against?
- A. Azure Cosmos DB (and anyone with access to the service) ever seeing plaintext values of protected properties
- B. Network-level attacks only
- C. Only attacks that occur during backup and restore
- D. Loss of the primary account key only
Q2. Where does encryption/decryption occur when using Always Encrypted?
- A. On the client side, before data leaves the application
- B. On the Cosmos DB server, before storage
- C. In transit only, using TLS
- D. Only during backup operations
Answer Key
Answers are listed at the very end so you can attempt the questions first.
- Q1 (Always Encrypted): A. Azure Cosmos DB (and anyone with access to the service) ever seeing plaintext values of protected properties — Always Encrypted ensures the database service itself never has access to plaintext values, protecting against server-side exposure.
- Q2 (Always Encrypted): A. On the client side, before data leaves the application — Always Encrypted performs client-side encryption/decryption, so sensitive data is never exposed in plaintext to the service.
DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page
