To enable Transparent Data Encryption (TDE) on a SQL Server instance, you must establish a trust hierarchy to secure the encryption keys. The process follows a strict dependency chain:

1. Master Key in master: First, create a Database Master Key (DMK) in the system master database. This key is used to encrypt certificates.
2. Certificate in master: Next, create a certificate in the master database, which is protected by the DMK created in the previous step.
3. Database Encryption Key in DB1: Finally, switch context to the user database (DB1) and create the Database Encryption Key (DEK). This DEK is encrypted using the certificate located in the master database.

After these three objects are created in sequence, you can set encryption to ON for the database.

Microsoft Learn - SQL Server: "Transparent data encryption (TDE)"

Section: "Enable TDE"

Step-by-step citation:

"Create a master key." (Code example: USE master; GO; CREATE MASTER KEY...)

"Create or obtain a certificate protected by the master key." (Code example: USE master; GO; CREATE CERTIFICATE...)

"Create a database encryption key and protect it by the certificate." (Code example: USE AdventureWorks2022; GO; CREATE DATABASE ENCRYPTION KEY...)

URL: https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption?view=sql-server-ver16#enable-tde

Microsoft Learn - Azure SQL VM: "Configure Transparent Data Encryption - SQL Server on Azure VMs"

Note: Confirms that for SQL Server on Azure VMs (IaaS), the manual TDE setup matches the on-premises SQL Server procedure involving the master database hierarchy.

URL: https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/transparent-data-encryption?view=azuresql