Forum Discussion

Ira_27's avatar
Ira_27
Helper II
1 month ago
Solved

Data encryption and decryption in Fabric

Hello,

 

Looking for ways to encrypt and decrypt columns having PII data in Lakehouse and Warehouse. Since Fabric doesnt support VBS enclave, is there a way to perform this? 

 

I went through a ton of resource but nothing specifically talks about implementation. 

 

https://community.fabric.microsoft.com/t5/Data-Warehouse/How-to-encrypt-and-decrypt-a-column-in-Fabric-Data-Warehouse/m-p/3906611#M258

 

 

data engineering
  • v-kathullac's avatar
    v-kathullac
    1 month ago

    Hi Ira_27 ,

     

    Thank you for reaching out to Microsoft Fabric Community Forum below are few points that may solve your issue.

    • Microsoft Fabric does not currently support Always Encrypted with Secure/VBS Enclaves for Lakehouse or Warehouse.
    • Native column-level encryption and decryption of PII data is not available in Fabric SQL.
    • Encrypt sensitive columns before ingesting data into Fabric using ETL pipelines, Spark notebooks, or external applications.
    • Manage encryption keys in Azure Key Vault instead of storing them within Fabric.
      Customer-Managed Keys (CMK) protect data at rest but do not provide column-level encryption or decryption.
    • Row-Level Security (RLS), Column-Level Security (CLS), and Dynamic Data Masking can help restrict access to PII but are not encryption mechanisms.
    • If Always Encrypted with Secure Enclaves is a strict requirement, consider storing sensitive data in Azure SQL Database or SQL Server and use Fabric for analytics.
    • Currently, there is no native workaround in Microsoft Fabric that provides SQL Server-like column encryption/decryption using VBS enclaves.

    Thanks,

    Chaithanya.

3 Replies

  • v-kathullac's avatar
    v-kathullac
    Community Support
    1 month ago

    Hi Ira_27 ,

     

    Thank you for reaching out to Microsoft Fabric Community Forum below are few points that may solve your issue.

    • Microsoft Fabric does not currently support Always Encrypted with Secure/VBS Enclaves for Lakehouse or Warehouse.
    • Native column-level encryption and decryption of PII data is not available in Fabric SQL.
    • Encrypt sensitive columns before ingesting data into Fabric using ETL pipelines, Spark notebooks, or external applications.
    • Manage encryption keys in Azure Key Vault instead of storing them within Fabric.
      Customer-Managed Keys (CMK) protect data at rest but do not provide column-level encryption or decryption.
    • Row-Level Security (RLS), Column-Level Security (CLS), and Dynamic Data Masking can help restrict access to PII but are not encryption mechanisms.
    • If Always Encrypted with Secure Enclaves is a strict requirement, consider storing sensitive data in Azure SQL Database or SQL Server and use Fabric for analytics.
    • Currently, there is no native workaround in Microsoft Fabric that provides SQL Server-like column encryption/decryption using VBS enclaves.

    Thanks,

    Chaithanya.

  • tayloramy's avatar
    tayloramy
    Super User
    1 month ago

    Hi Ira_27, 

     

    If always encrypted columns are a requirement for you, then I'd suggest using SQL Databases in Fabric, which is essentially an Azure SQL database that sits on Fabric compute. 

     

    If data masking is all that you need, then you can do that in Fabric warehouses.  

  • v-kathullac's avatar
    v-kathullac
    Community Support
    1 month ago

    Thankyou tayloramy    for Addressing the issue.

     

    Hi  Ira_27   ,

    Thank you for reaching out to Microsoft Fabric Community Forum,

     

    As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided  for the issue worked? or Let us know if you need any further assistance?

     

    Regards,

    Chaithanya