Score:0

Can I move my encryption key (used for SQL always encrypted) from a key vault in one Azure tenant to another?

us flag

We have migrated a database (backup to .bacpac and restore to the new tenant) but the database was encrypted using always encrypted and the key is stored in the original tenant's key vault. I can look at the data in SQL management studio by authenticating with the first tenant when it tries to decrypt (it automatically pops up the authentication dialog), but I need to move the key so my web app can access it too. Can it be migrated from one tenant to another, or is this going to become a manual process of exporting and re-importing the data?

Score:1
us flag

An update on this: The short answer is yes, it's possible to move the keys from one tenant to another, but there's a caveat:

  1. The tenant must exist in the same subscription. If it doesn't, you have to first transfer the tenant to the same subscription as the destination tenant you want the keys to be moved to - an account on both with sufficient rights is required to perform this step.
  2. The entire key vault is migrated. the keys are tied to the vault and can't be used in another vault.
Carl in 't Veld avatar
cn flag
Could you change the wording of your answer a bit? In Azure vocabulary a tenant does not exist in a subscription. It is the other way around: a tenant owns possibly multiple subscriptions. I assume for your migration use case it is required that both the source subscription as well as the target subscription reside in the same tenant?
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.