Feature
Microsoft
Microsoft retires Always Encrypted with secure (Intel SGX) enclaves in Azure SQL Database on 31 October 2027 as SGX-enabled DC-series hardware is phased out; customers must move to Virtualization-Based Security (VBS) enclaves or SQL Server on Confidential VMs
departs 31 Oct 2027
Quick answers
- Is it true that Azure SQL Database retires Always Encrypted with Intel SGX enclaves on 31 October 2027 — migrate to VBS enclaves?
- Yes. Microsoft has officially announced it, effective 31 Oct 2027. If your Azure SQL Database uses Always Encrypted with secure enclaves backed by Intel SGX — the feature that lets the database perform rich computations (pattern-matching, range comparisons, in-place encryption) on encrypted columns without exposing the keys — that capability is being retired on 31 October 2027 as the underlying SGX-enabled DC-series hardware is phased out.
- When does it take effect?
- 31 Oct 2027. Verified against the vendor's own announcement.
- What should I use instead?
- Microsoft's recommended path is to migrate from Intel SGX enclaves to Virtualization-Based Security (VBS) enclaves, which it describes as a hardware-independent alternative — so you are not tied to a specific confidential-compute SKU.
What this means for you
If your Azure SQL Database uses Always Encrypted with secure enclaves backed by Intel SGX — the feature that lets the database perform rich computations (pattern-matching, range comparisons, in-place encryption) on encrypted columns without exposing the keys — that capability is being retired on 31 October 2027 as the underlying SGX-enabled DC-series hardware is phased out. After retirement, workloads using Intel SGX enclaves lose enclave functionality: confidential queries that depend on the enclave stop working, and databases still on DC-series compute must be moved to supported tiers. Encrypted columns themselves remain encrypted and your data is not lost, but the enclave-powered operations on them stop.
Where to go
Microsoft's recommended path is to migrate from Intel SGX enclaves to Virtualization-Based Security (VBS) enclaves, which it describes as a hardware-independent alternative — so you are not tied to a specific confidential-compute SKU. For workloads that need hardware-rooted confidentiality, the alternative Microsoft names is SQL Server on Confidential VMs. Either way, databases currently running on DC-series compute tiers should be moved to supported compute tiers to keep enclave-enabled features working. Plan the switch of enclave type and the compute-tier move together, and re-test any queries that rely on enclave computations against encrypted columns.
- Virtualization-Based Security (VBS) enclaves in Azure SQL Database — Microsoft's named hardware-independent replacement
- SQL Server on Confidential VMs — for workloads that require hardware-rooted confidential computing
Microsoft is retiring one of the two hardware backings for Always Encrypted with secure enclaves in Azure SQL Database. Per Microsoft’s official Azure release-communications notice, Always Encrypted with Intel SGX enclaves will retire on 31 October 2027 as support for SGX-enabled DC-series hardware is phased out.
What this affects
Always Encrypted with secure enclaves is the feature that lets Azure SQL run richer operations — pattern matching, range comparisons, in-place encryption — directly on encrypted columns inside a protected enclave, without the server ever seeing the keys. Intel SGX was the original hardware root for that enclave on DC-series compute.
After the retirement date:
- Workloads using Intel SGX enclaves lose enclave functionality — the confidential computations that depend on the enclave stop working.
- Databases on DC-series compute tiers need to move to supported tiers to keep enclave-enabled features at all.
Your encrypted columns stay encrypted and no data is lost; what goes away is the SGX-backed enclave processing over them.
What to do
Microsoft’s recommended migration is to move from Intel SGX enclaves to Virtualization-Based Security (VBS) enclaves, described as a hardware-independent alternative — so the replacement does not pin you to a particular confidential-compute SKU. For workloads that specifically need hardware-rooted confidentiality, Microsoft points to SQL Server on Confidential VMs.
Practically, plan two changes together: switch the enclave type to VBS, and move any database still on DC-series compute to a supported tier. Then re-test the queries that rely on enclave computations over your encrypted columns before the 31 October 2027 cutoff.
Entry changelog
- — last reviewed.
- — Entry created from Microsoft's Azure release-communications notice (id 569236, published 2026-10-06): Always Encrypted with Intel SGX enclaves in Azure SQL Database retires 31 October 2027 as SGX-enabled DC-series hardware is phased out; migrate to VBS enclaves or SQL Server on Confidential VMs. sunsetDate set to 2027-10-31. No detect: fingerprint — the enclave attestation configuration is server-side and not expressed as a repository dependency or literal token the primary source names.
Put this countdown in your README
Building on Microsoft? Drop this badge into a project’s README or docs — it shows the days left and
refreshes on its own every night from this page. 
[](https://lastcall.dev/entries/azure-sql-always-encrypted-intel-sgx-enclaves-retirement)Spot an error or a changed date? Tell us and it’s corrected the same night.