SQL MI - manual backups failing on databases with encryption ON

Question

anyone came across failing manual backups on SQL MI recently, since yesterday TDE kicked in and databases created had Encryption set to ON?

SOLUTION: to explicitly backup database to blob storage you need to set encryption to OFF before triggering manual backup

Answer 1

Transparent Data Encryption don't allow you to do manual backups in Managed Instance. TDE encrypts data and backups with internal TDE keys that are periodically rotated. Since you cannot export current TDE key you could not decrypt backup, and since the current TDE key will be replaced with the new one, Azure would not be able to restore your encrypted backup after some time.

Therefore RESTORE is not enabled if TDE is ON. This is documented here:

https://learn.microsoft.com/en-us/azure/sql-database/sql-database-managed-instance-transact-sql-information#tde-encrypted-databases-dont-support-user-initiated-backups