When AI meets your database: Securing sensitive data in Azure SQL in an AI-driven world
Description
As AI becomes embedded in every application, protecting sensitive data in Azure SQL is vital. This session explores how to secure sensitive data from AI agents and design a defense-in-depth model using Azure SQL's existing security stack - modern authentication, granular access control, data protection, monitoring, auditing, and more. Learn how to confidently use Azure SQL to power AI applications.
Key Takeaways
- AI introduces new attack surfaces: LLMs querying databases via natural language can inadvertently expose sensitive data through prompt injection, over-permissioning, or data leakage in model responses
- Always Encrypted with Secure Enclaves: data remains encrypted even during query processing — the database engine never sees plaintext, even for AI workloads querying sensitive columns
- Azure SQL Ledger: cryptographically verifiable, immutable audit trail — proves data hasn't been tampered with, critical for AI training data integrity and compliance (SOC2, PCI-DSS)
- Transparent Data Encryption (TDE) with Customer-Managed Keys: you control the encryption keys, not Microsoft — essential for regulated industries using AI on sensitive data
- Least-privilege for AI agents: AI agents querying Azure SQL should use contained database users with minimal permissions — never sa or db_owner
- Microsoft Purview integration: classify and discover sensitive data in Azure SQL before exposing it to AI — know what's sensitive before AI can access it
- Shoham Dasgupta is a long-time Azure SQL security contributor at Microsoft — has published extensively on TDE, Always Encrypted, and Zero Trust for SQL
My Notes
Action Items
- [ ]