0

I'm trying to encrypt fields using AlwaysEncrypt in SSMS with a key stored in Azure vault. I've created a vault and a key given it all the permissions (so I don't miss anything, I know I shouldn't give it all of the permissions eventually, just what it needs).

Following through the encryption wizard, I can log into my Azure account and everything proceeds nicely until the final commit, when it fails with the following message.

Dec 31 2019 10:59:10 [Informational] TaskUpdates: Message:Task: 'Generate new column master key CMK_Auto2 in Azure Key Vault MyVault' -- Status: 'Started' -- Details: 'Task 'Generate new column master key CMK_Auto2 in Azure Key Vault MyVault' started ....'.

Dec 31 2019 10:59:10 [Informational] TaskUpdates: Message:Task: 'Generate new column master key CMK_Auto2 in Azure Key Vault MyVault' -- Status: 'Failed' -- Details: 'Task failed due to following error: Access denied. Caller was not found on any access policy.
Caller: appid=aGUID;numgroups=0;iss=https://sts.windows.net/anotherGUID/
Vault: MyVault;location=ukwest'.

Dec 31 2019 10:59:10 [Informational] WorkitemExecution: Message:Work item 'Generate new column master key CMK_Auto2 in Azure Key Vault MyVault' stopped..

Dec 31 2019 10:59:10 [Error] WorkitemExecution: Message:Work item 'Generate new column master key CMK_Auto2 in Azure Key Vault MyVault' did not complete. Details: Access denied. Caller was not found on any access policy.
Caller: appid=aGUID;numgroups=0;iss=https://sts.windows.net/anotherGUID/
Vault: MyVault;location=ukwest'.

Any ideas which permissions I need to add to somewhere or what I'm pointing incorrectly to?

Glyn
  • 316
  • 2
  • 20
  • Did you create an app registration and grant the permissions to that app? Check this out...https://stackoverflow.com/questions/40025598/azure-key-vault-access-denied – Nate Jan 01 '20 at 20:01
  • Regarding the issue, please refer to https://learn.microsoft.com/en-us/azure/sql-database/sql-database-always-encrypted-azure-key-vault?tabs=azure-powershell. – Jim Xu Jan 02 '20 at 06:49
  • Does the SQL server database have to be in Azure? My database is on my PC and I'm trying to connect from there. – Glyn Jan 10 '20 at 09:49
  • @Glyn did you ever figure out question? I'm trying to connect my local database to keyvault. – Zach L Dec 10 '20 at 20:40
  • @zachattack No sorry, it got pushed to the back of the queue. I'll post an answer when I get round to figuring it out ;) – Glyn Jan 04 '21 at 13:28

0 Answers0