Always Encrypted with Azure Key Vault
Bradley Schacht is a Principal Program Manager on the Microsoft Fabric product team based in Saint Augustine, FL. Bradley is a former consultant, trainer, and has coauthored 6 SQL Server and Power BI books, most recently Learn Microsoft Fabric. As a member of the Microsoft Fabric product team, Bradley works directly with customers to solve some of their most complex data problems and helps shape the future of Microsoft Fabric. Bradley gives back to the community through speaking at events such as the SQLBits, Fabric Community Conference, PASS Community Data Summit, SQL Saturdays, Code Camps, and user groups across the country including locally at the Jacksonville SQL Server User Group (JSSUG). He is a contributor on SQLServerCentral.com and blogs on his personal site, BradleySchacht.com.
If Key Vault is not shown in the Featured column select See all in the upper right-hand corner of the New page and locate Key Vault in the Security + Protection section of the Security + Identity blade. 
From the list of key vaults click on the name of the vault where you would like to use to manage the Always Encrypted keys. 
From the navigation click Keys. 
Click Add from the list of options at the top of the Keys blade. 
On the Create a Key blade select Generate from the Options drop down and enter a name for the key. Click Create. 
On the Keys page, click the Refresh button and ensure the new key appears with a status of Enabled. 
Before SQL Server will be able to access the keys we need to ensure the appropriate access policies are in place. They required permissions are create, get, list, sign, verify, wrap and unwrap. Close the Keys page to return to the Key Vault overview. Click on Access policies from the navigation list. A list of users will be shown. Select your account from the user list. 
On the Key permissions drop down ensure create, get, list, sign, verify, wrap and unwrap are all selected. By default sign, verify, wrap and unwrap will not be selected. Click OK. 
Finally, click Save** on the Access policies page. 
Provide a name for the key. Change the Key store option to Azure Key Vault in the drop down. If prompted, click the Sign In button and authenticate with your credentials. 
Upon successful authentication to the Azure environment, select the appropriate subscription, key vault and key from the options presented. Click OK to close the wizard. 
Note: As an alternative to the previous section, Generate a Key in Azure Key Vault, a new key can be created from the New Column Master Key wizard on this screen by clicking the Generate Key button. Expanding the Column Master Keys folder in the SSMS navigation tree will show the newly created key. 
Scripting the key reveals, as expected, that there is no key stored locally, but instead the key resides in Azure Key Vault at the URL shown. 
Expanding the Column Encryption Keys folder in the SSMS navigation tree will show the newly created key. 
To start, locate the table containing the columns to be encrypted in the SQL Server Object Explorer in SQL Server Management Studio. Right-click the table and choose Encrypt Columns. The Always Encrypted wizard will launch. It is possible to generate keys through the wizard but it provides much less control than the above process or generating and uploading keys using PowerShell. 
If displayed, click Next on the Introduction page. On the Column Selection page click the check box next to the column(s) to be encrypted. In this example, that is the SocialSecurityNumber column. Choose either deterministic or randomized in the Encryption Type and select the column encryption key created in the previous section in the Encryption Key column. Notice in the Encryption Key drop down menu there is an option called CEK_Auto followed by a number and the text (New). Choosing this option will generate a new column encryption key rather than leveraging the key that has already been created. Click Next. 
Because we chose to use existing keys there is no configuration necessary on the Master Key Configuration page. Simply click Next. Had the CEK_Auto option been selected on the prior screen the Master Key Configuration page would have looked similar to the wizard in the Column Master Key section of this post. On the Run Settings page click Next. If the table contains are large amount of data or the table is actively being written to it is advisable to change the option to Generate PowerShell script to run later and schedule the encryption to run during an off hours maintenance time. 
On the Summary page click Finish. The encryption process will begin. The wizard will automatically proceed to the Results page upon completion of the encryption process. If any errors occur click the link to view the Always Encrypted Wizard Log Report. Otherwise, click Close. 
Rerunning a SELECT command on the table will reveal the SocialSecurityNumber column is now encrypted. 
A look at the table definition shows the changes that have been made to the DDL. Notice the data type is still listed as CHAR(11) but the data is being stored in binary format. Here we can also see the column encryption key being used and the encryption type is set to randomized. 
It is worth noting that the table can be created empty with the column encryption specified, it does not need to be created and then have encryption applied using the Always Encrypted wizard.
When connection to the server expand the Options on the Connect to Server dialog, switch to the Additional Connection Parameters page and enter the text Column Encryption Setting = Enabled. Then, click Connect. 
Now, when running queries in SSMS against a table with encrypted data you may be prompted to authenticate to Azure before being shown the decrypted data. 
Note: If using Azure Key Vault. There will be no authentication if using the local Windows Certificate Store which was not covered in this post.