Retirement: Always Encrypted with Intel SGX Enclaves

Always Encrypted with Intel SGX enclaves in Azure SQL Database will retire on October 31, 2027 as support for SGX-enabled DC-series hardware is phased out. Customers should transition to Virtualization-Based Security (VBS) enclaves, a hardware-independent alternative, or consider SQL Server on Confidential VMs. Customer impact After retirement, workloads using Intel SGX enclaves will no longer have enclave functionality. Databases running on DC-series compute tiers should be migrated to supported compute tiers to continue using enclave-enabled features. Recommended actions

- Migrate from DC-series to a supported Standard-series (non-DC) compute tier.

- Enable VBS enclaves for Always Encrypted. No attestation is required.

- Update client drivers to versions that support VBS enclaves.

- Update connection strings to remove SGX attestation parameters and use VBS enclave mode.

We recommend planning and validating your migration well in advance of the retirement date to ensure a smooth transition.