To implement Cell-Level Encryption in Azure SQL Database, you must establish the encryption key hierarchy. First, create a database master key (DMK), which is the root of encryption in the database. Second, create a certificate protected by the DMK. Third, create a symmetric key protected by the certificate (symmetric keys are used for the actual data encryption due to performance). Finally, update Col1 with the encrypted values using the EncryptByKey function. Note: While OPEN SYMMETRIC KEY is a required session command to perform the update, the high-level actions that define the configuration and application of encryption are the creation of the three hierarchy objects and the data update itself.

Microsoft Learn. (2025). Encrypt a Column of Data. Retrieved from https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/encrypt-a-column-of-data?view=sql-server-ver16 (Sections: "Create database master key", "Create a certificate", "Create a symmetric key", "Encrypt the data").

Microsoft Learn. (2025). CREATE SYMMETRIC KEY (Transact-SQL). Retrieved from https://learn.microsoft.com/en-us/sql/t-sql/statements/create-symmetric-key-transact-sql

Microsoft Learn. (2025). Encryption Hierarchy. Retrieved from https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/encryption-hierarchy