This is a sample C# client app used to demo the coding aspects of Always Encrypted with VBS enclaves using the ContosoHR Database.

The raw SQL files are here: https://github.com/microsoft/sql-server-samples/blob/master/samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-vbs/setup/PopulateDatabase.sql

...and the entire repo is here https://github.com/microsoft/sql-server-samples/tree/master/samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-vbs.

To setup, you need an environment variable named ConnectContosoHR that is the connection string to your Azure SQL DB instance. eg; Server=tcp:XXXXXXXserver.database.windows.net;Database=ContosoHR;

Don't put the enclave-specific settings in the connection string, these are added by the code so you can demo with- and without-AE.

When the code runs, there's a flag in the code: bool useAlwaysEncrypted = true;

You can set this to false and run the code, and then true and re-run.

• When useAlwaysEncrypted==false, you will see a hex dump of the ciphertext fields, SSN and Salary.
• When useAlwaysEncrypted==true, the code will change the connection string to support AE and then display the plaintext for SSN and Salary.