Microsoft announced on October 7 that Azure SQL Database will retire Intel SGX enclaves for Always Encrypted on October 31, 2027. The change affects this specific secure-enclave configuration on DC-series compute, not Azure SQL Database or Always Encrypted as a whole.

Affected applications need a planned migration. Microsoft's guidance says remaining DC-series databases will automatically move to supported non-DC compute with VBS enclaves after the deadline, but application drivers, connection strings and attestation settings still need review and testing.

VBS enclaves in Azure SQL Database do not provide the same host-isolation protections as Intel SGX. Organizations needing stronger host isolation should assess SQL Server on Azure confidential VMs rather than assume the options are interchangeable.

See the Microsoft announcement and migration guide for affected-resource checks, security considerations and validation steps.