fabrical.
Back to feed
Fabric Recent Update·Mar 26, 2026·Pieter Vanhove

Customer-managed keys (CMK) in Fabric SQL Database (Generally Available)

View original article

If you haven’t already, check out Arun Ulag’s hero blog “FabCon and SQLCon 2026: Unifying databases and Fabric on a single, complete platform” for a complete look at all of our FabCon and SQLCon announcements across both Fabric and our database offerings. 

Customer-managed keys (CMK) in Fabric SQL Database is a major step forward in empowering organizations to take control of their data security and compliance.

Why customer-managed keys matter

Microsoft Fabric already encrypts all data-at-rest using Microsoft-managed keys. But for organizations with strict data governance policies or regulatory requirements, CMK offers an additional layer of control and flexibility.

With CMK, you can use your own Azure Key Vault keys to encrypt SQL database data in Fabric workspaces, giving you:

  • Key ownership and rotation control.
  • Granular access management.
  • Auditability of key usage.
  • Compliance with industry-specific encryption standards.

Seamless integration with Transparent Data Encryption

Once CMK is configured for a Fabric workspace, Transparent Data Encryption is automatically enabled for all SQL databases (including tempdb) in that workspace. This means:

  • Real-time encryption and decryption of data, backups, and transaction logs.
  • Encryption at the page level using a symmetric Database Encryption Key (DEK).
  • DEK protection via the customer-managed asymmetric key from Azure Key Vault.

Diagram illustrating encryption process for Azure SQL data protected by TDE. It shows TDE protector CMK encrypting Database Encryption Key (DEK), which decrypts SQL database in Fabric that stores data in encrypted Azure storage, with arrows indicating encryption and decryption flow.

Figure: Encryption process for Azure SQL data protected by TDE.

No manual steps are required. Encryption begins automatically and applies to both existing and newly created databases.

Get started

Follow the steps on Customer-managed keys for Fabric workspaces to enable encryption using customer-managed keys.

Query to verify successful CMK encryption

After you enable CMK for the workspace, Fabric automatically encrypts (1) any existing SQL databases in that workspace and (2) any new SQL databases you create in that workspace going forward. To confirm that a specific database is encrypted, run the following query:

SELECT DB_NAME(database_id) as DatabaseName, *

FROM sys.dm_database_encryption_keys

WHERE database_id <> 2

A database is encrypted if the encryption_state_desc field displays “ENCRYPTED” (or “ENCRYPTION_IN_PROGRESS” during encryption) with ASYMMETRIC_KEY as encryptor_type; otherwise, it will not show up in this DMV if the database is not encrypted.

Screenshot of query result set of the SYS.DM_DATABASE_ENCRYPTION_KEYS DMV. Notable entries include AES algorithm with a 256-bit key, highlighted terms "ASYMMETRIC," "ENCRYPTED," and "COMPLETE," indicating successful encryption processes.

Figure: Result set of the query to verify if your database is successfully encrypted.

Learn more

We hope you enjoy this new offer; we look forward to your feedback as we continue to enhance data security in Microsoft Fabric. Please leave your thoughts in the comment section!

Related blog posts

Customer-managed keys (CMK) in Fabric SQL Database (Generally Available)

SQL Server Management Studio (SSMS) 22.4.1 and GitHub Copilot in SSMS (Generally Available)

GitHub Copilot in SQL Server Management Studio (SSMS) now offers a few highly requested features and several bug fixes based on feedback items. Check out the full release notes to learn about the complete list of updates in the 22.4.1 release. We appreciate you taking time to file issues, share your requests, and upvote items; you’ll notice your feedback helped us shape this release, and will help us continue to evolve the GitHub Copilot in SSMS integration.

Batteries included: Database DevOps with SQL projects

Database changes shouldn’t be the last manual step in your release process. As teams adopt DevOps practices to ship application code faster and more reliably, the database has remained a sticking point—manual scripts, inconsistent deployments, and limited visibility into what changed and when. SQL projects change that by making database schema a first-class citizen in source control, CI/CD pipelines, and collaborative development workflows.

Microsoft Fabric

Accelerate your data potential with a unified analytics solution that connects it all. Microsoft Fabric enables you to manage your data in one place with a suite of analytics experiences that seamlessly work together, all hosted on a lake-centric SaaS solution for simplicity and to maintain a single source of truth.

Get the latest news from Microsoft Fabric Blog

This will prompt you to login with your Microsoft account to subscribe

Visit our product blogs

View articles by category

View articles by date

What's new

Microsoft Store

Education

Business

Developer & IT

Company

  • © 2026 Microsoft
  • Manage Cookies
  • Contact Microsoft
  • Privacy
  • Terms of use
  • Trademarks
  • About our ads
#Databases#Microsoft Fabric