I can't backup database via SSMS on Azure sql managed instance

any update??

I sent you multiple emails !!

please help and send me pm for next communication

Hi Shlomi Rachamim,

I went through the error message and here are the possible causes and fixes.

Cause:

• On Azure SQL Managed Instance, databases are encrypted by default using service-managed Transparent Data Encryption (TDE).
• Native BACKUP DATABASE to .bak files (like on-prem SQL Server) is not supported when TDE is service-managed.

You have two supported options for backup.
Use Azure-native backup/restore

• Managed Instance automatically takes full, differential, and log backups.
• You can restore to a point in time using Azure Portal, PowerShell, or Azure CLI.
• Docs: https://free.blessedness.top/azure/azure-sql/managed-instance/automated-backups-overview

Export to BACPAC

• If you need a copy outside the instance, export the database to a BACPAC file (schema + data)

If you need .bak backups

• Only possible if you disable TDE (not recommended for production).
• Or use customer-managed TDE keys (BYOK) and then use Managed Instance native backup/restore to Azure Blob Storage.

I hope this information is helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Thanks,

Abhisek

1. How to disable TDE?
2. Why it's not recommended for production ?

Hi Shlomi Rachamim,

Please find below, the answers for the questions you asked.

How to Disable TDE in Azure SQL

Transparent Data Encryption (TDE) is enabled by default for all new Azure SQL Databases and Managed Instances. To disable it:

1. Run T-SQL Command ALTER DATABASE [YourDatabase] SET ENCRYPTION OFF; This starts the decryption process. You can monitor progress using: SELECT`` db.name, dm.encryption_state, dm.percent_complete FROM`` sys.databases db LEFT`` JOIN sys.dm_database_encryption_keys dm ON`` db.database_id = dm.database_id WHERE`` db.name = 'YourDatabase'; When percent_complete reaches 100 and encryption_state changes to 1, the database is decrypted.
2. Drop the Database Encryption Key DROP DATABASE ENCRYPTION KEY; This fully removes TDE from the database.

Why Disabling TDE Is Not Recommended for Production

• Security Risk: TDE protects data at rest (database files, backups, transaction logs). Disabling it means these files are stored in plain text, increasing exposure if storage media or backups are compromised.
  https://free.blessedness.top/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview?view=azuresql&tabs=azure-portal
• Compliance Impact: Many regulatory frameworks (e.g., PCI DSS, HIPAA) require encryption at rest. Turning off TDE can lead to non-compliance.
• Minimal Performance Overhead: TDE uses AES-NI hardware acceleration, so the CPU impact is very small. Disabling it for performance reasons is rarely justified.
• Best Practice: Keep TDE enabled and, if needed, use customer-managed keys for more control instead of disabling encryption.

Thanks,

Abhisek