Retirement: Always Encrypted with Intel SGX Enclaves

Always Encrypted with Intel SGX enclaves in Azure SQL Database will retire on October 31, 2027 as support for SGX-enabled DC-series hardware is phased out. Customers should transition to Virtualization-Based Security (VBS) enclaves, a hardware-independent alternative, or consider SQL Server on Confidential VMs.

Customer impact

After retirement, workloads using Intel SGX enclaves will no longer have enclave functionality. Databases running on DC-series compute tiers should be migrated to supported compute tiers to continue using enclave-enabled features.

Recommended actions

• Migrate from DC-series to a supported Standard-series (non-DC) compute tier.
• Enable VBS enclaves for Always Encrypted. No attestation is required.
• Update client drivers to versions that support VBS enclaves.
• Update connection strings to remove SGX attestation parameters and use VBS enclave mode.

We recommend planning and validating your migration well in advance of the retirement date to ensure a smooth transition.