Confidential Databases 2026: Enclaves vs Encrypted Indexes

Q: What does "encrypted in use" actually mean for a database?

It means the database can execute queries over data it cannot read, which is only possible if some comparison the engine used to make is replaced by something that works on ciphertext or inside a protected region. In practice there are three ways to do that: encrypt fields on the client and give the server special indexes it can match without a key, as MongoDB Queryable Encryption does; put a small piece of the engine inside an enclave that receives the key over a secure channel and returns only comparison results, as Always Encrypted with secure enclaves does; or run the whole database inside a confidential virtual machine whose memory is encrypted against the hypervisor. Each hides data from a different adversary and keeps a different set of operators, which is why the phrase alone does not tell you what you are buying.

Q: What changes when Azure SQL Database retires Intel SGX enclaves on 31 October 2027?

Microsoft's planning and migration pages state that Always Encrypted with Intel SGX enclaves reaches end of support on 31 October 2027, and that after that date any database still on the DC-series compute tier is moved automatically to a standard-series tier with virtualisation-based security (VBS) enclaves enabled. VBS enclaves in Azure SQL Database do not support attestation and, in Microsoft's words, provide no protection from attacks using privileged system accounts originating from the host. So a workload whose threat model included the cloud operator loses that property silently unless it migrates deliberately, either by accepting VBS and rewriting the threat model, or by moving to SQL Server on an Azure confidential VM with VBS enclaves and optional Host Guardian Service attestation. Applications must also switch their connection strings to the None attestation protocol and drop the Azure Attestation URL.

Q: Which queries can MongoDB Queryable Encryption run on encrypted fields in 2026?

Equality queries since MongoDB 7.0, range queries with $lt, $lte, $gt and $gte since 8.0, and prefix, suffix and substring queries on string fields, which were in public preview in 8.2 and became generally available in MongoDB 9.0 on 28 September 2026. Each encrypted field is configured for one query type at collection creation and cannot be changed later; updates are limited to $set and $unset; $lookup can reference multiple encrypted collections from 8.1 but not join on an encrypted field; and comparing two encrypted fields to each other is not supported. Automatic encryption, where the driver rewrites queries transparently, requires MongoDB Enterprise Advanced or Atlas, while explicit encryption works on Community Edition from 7.0 on replica sets and sharded clusters but not standalones.

Q: Does a confidential VM such as Azure Database for PostgreSQL on AMD SEV-SNP protect data from my own DBAs?

No. A confidential VM encrypts the virtual machine's memory against the hypervisor and the cloud operator and requires no application changes, which is exactly why every operator and every login behaves as before. A database administrator, anyone with a broad read grant, a logical replication consumer and an application with a leaked connection string all read plaintext. Microsoft's own documentation for the PostgreSQL flexible server confidential option lists remote attestation as not available for the managed service, supports only AMD SEV-SNP in two regions, and does not allow point-in-time restore from a non-confidential server. It is the right control for an adversary that is the cloud provider or a co-tenant on the host, and the wrong one for an insider threat model.

Q: What extra queries does Always Encrypted with secure enclaves allow compared with plain Always Encrypted?

Plain Always Encrypted lets the engine perform only equality comparison on deterministically encrypted columns, and all other operations including initial encryption and key rotation had to be done on the client. With a secure enclave, on randomly encrypted columns the engine can run comparison operators, BETWEEN, IN, LIKE, DISTINCT, joins, ORDER BY and GROUP BY (ORDER BY and GROUP BY from SQL Server 2022 and in Azure SQL Database; SQL Server 2019 supports only nested loop joins), and it can encrypt, re-encrypt and rotate keys in place with ALTER TABLE. The conditions are randomised encryption with enclave-enabled keys, a _BIN2 or UTF-8 collation on string columns, and an understanding that an index on such a column is sorted by plaintext and therefore reveals ordering to anyone who can scan it.

Q: Why is it dangerous to make a field range-queryable?

Because a range query is only answerable if the server can order ciphertexts by their plaintext values, so an index that supports ranges publishes the ordering of the column. Microsoft's documentation gives the example of a malicious DBA scanning an enclave-backed index on a salary column to find the maximum encrypted value and identify the highest earner when the name column is in plaintext. MongoDB's limitations page states that range queries are especially exposed to an adversary who can obtain database snapshots together with even a small number of query logs. The design rule is to default every encrypted field to non-queryable, grant equality only where lookups need it, and grant range only where the product genuinely runs range queries and the ordering of that field is not itself the secret.

Q: Where should column master keys live, and who should be allowed to hold them?

In a key management service or key vault whose access policy excludes the database role and the DBA role entirely; Always Encrypted supports only Windows Certificate Store and Azure Key Vault for enclave-enabled column master keys, and MongoDB uses a customer master key in a supported KMS to wrap data encryption keys. The client driver holds the data keys in memory and is the policy enforcement point, because it is the only component that can turn plaintext into tokens or encrypted parameters. Microsoft's planning guidance for enclave attestation also separates three roles, attestation administrator, DBA and application administrator, and states that if the goal is to keep DBAs from the data, DBAs must not control attestation policy. The moment a DBA holds the column master key, even for a migration script, every encrypted row collapses to ordinary at-rest encryption.

Q: When should I refuse to encrypt a field in use at all?

When the business needs arbitrary analytics over the field, because no in-use encryption scheme can support aggregation, sorting and grouping over a column without revealing the statistics it was meant to hide, and the vendor limitations pages are explicit that group-by over encrypted fields, text search and many expressions are not supported. In that case the honest designs are to minimise or tokenise the field, to move the analytics into a data clean room or a secure multi-party computation protocol where the other parties are organisations rather than roles, or to accept at-rest encryption with strong access control and audit. Field minimisation beats field encryption whenever it is available, and a written list of the fields that will never be encrypted in use, with the reason, is part of a defensible design rather than a gap in it.

Satyam Kumar

Back to Blog

architecture

Confidential Databases: Encryption in Use Is a Query-Shape Decision, So Choose the Boundary by Which Operator Must Run Blind, Not by the Word "Confidential" (2026)

By Satyam KumarOctober 21, 202619 min read

confidential database encryption in use always encrypted secure enclaves vbs enclaves intel sgx retirement mongodb queryable encryption client-side field level encryption confidential vm database amd sev-snp intel tdx azure sql database security azure database for postgresql confidential enclave attestation column master key kms dba data access control encrypted indexes

Confidential Databases: Encryption in Use Is a Query-Shape Decision, So Choose the Boundary by Which Operator Must Run Blind, Not by the Word "Confidential" (2026)

Frequently Asked Questions

Share this article

Twitter LinkedIn WhatsApp

Satyam Kumar

Founder & AI Architect, AppScale LLP

AI & Cloud Architect. Helping teams build systems that scale to millions.

LinkedIn GitHub

Confidential Databases: Encryption in Use Is a Query-Shape Decision, So Choose the Boundary by Which Operator Must Run Blind, Not by the Word "Confidential" (2026)

Frequently Asked Questions

Share this article

Comments

Leave a comment