---
title: "Fortanix DSM with Microsoft SQL Server TDE - Before You Begin"
slug: "fortanix-dsm-with-microsoft-sql-server-tde-integration-before-you-begin"
updated: 2026-04-01T08:15:39Z
published: 2026-03-21T17:38:36Z
canonical: "support.fortanix.com/fortanix-dsm-with-microsoft-sql-server-tde-integration-before-you-begin"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Microsoft SQL Server TDE - Before You Begin

## 1.0 Introduction

This article describes the steps that must be performed before integrating **Fortanix-Data-Security-Manager (DSM)** with **Microsoft SQL Transparent Data Encryption (TDE)**.

### 1.1 Limitations and Restrictions

- You must be a highly privileged user (such as a system administrator) to create a database encryption key and encrypt a database. That user must be able to be authenticated by the EKM module.
- Upon startup, the database engine must open the database. To do this, you should create a credential that can be authenticated by the EKM and associate it with a login based on an asymmetric key. Users cannot sign in using this login, but the database engine will be able to authenticate itself with the EKM device.
- If the asymmetric key stored by EKM Provider (Fortanix DSM) is lost, SQL Server will not be able to open the database. Hence, it is recommended not to delete or manually modify SQL Server–managed keys from Fortanix DSM manually. Even after key rotation, it is recommended to retain old keys, so that older backups can be restored in contingency scenarios.
- Ensure you have access to install and configure the Fortanix KMS Server file on the machine and user account where it will be deployed.

### 1.2 Permissions

This document uses the following permissions:

- To change a configuration option and run the `RECONFIGURE` statement, you must be granted the `ALTER SETTINGS` server-level permission. The `ALTER SETTINGS` permission is implicitly held by the System Administrator and the Server Administrator, who hold fixed server roles.
- Requires `ALTER ANY CREDENTIAL` permission.
- Requires `ALTER ANY LOGIN` permission.
- Requires `CONTROL` permission on the database to encrypt the database.
- Requires `CREATE ASYMMETRIC KEY` permission.

## 2.0 Prerequisites

Ensure the following:

- The Fortanix CNG Client must be installed and configured.
- Port 443 must be accessible from the SQL target machine to Fortanix DSM.

| Protocol | Inbound/Outbound | Port Number | Load balancer (Yes/No) | Purpose |
| --- | --- | --- | --- | --- |
| **TCP** | Outbound | 443 | No | HTTPS – Used for calling the REST API. MS-SQL server will access the cluster/SaaS URL on this port. Each individual node will also need this port open. |
- The SQL Server must be installed and configured on the target machine.
- Administrators are privileged to access SQL Server Management Studio from the target machine.

## 3.0 Fortanix CNG Provider

The Fortanix CNG Provider must be installed on every target machine. *For more information on how to download the CNG Provider, refer to* [*Fortanix CNG/EKM*](https://fortanix.zendesk.com/hc/en-us/sections/27488968118932-CNG-EKM)*.*

`FortanixKmsClient.msi` installs the Fortanix CNG Provider, as well as an EKM provider and the PKCS#11 library. Next, to configure the CNG client, Fortanix CNG Provider communicates with Fortanix DSM for crypto operations.

### 3.1 Installation

Perform the following steps to complete the installation on your machine:

1. On the **Fortanix KMS Client Setup** dialog box, click **Next**.

![Image1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13159487777428.png)

**Figure 1: Fortanix KMS client setup**
2. Select the **I accept the terms in the License Agreement** check box and click **Next**.

![Image2.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13159487790612.png)

**Figure 2: Fortanix KMS client setup**
3. Enter the location for installing the **Fortanix KMS Client** as **C:\Program Files\Fortanix\KMS Client\**.

![Image3.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13159504044948.png)

**Figure 3: Fortanix KMS client setup**
4. Click **Install** to install the Fortanix KMS client.

![Image4.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13159504045204.png)

**Figure 4: Fortanix KMS client setup**
5. After the installation is done, click **Finish**.

![Image5.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13159487887892.png)

**Figure 5: Fortanix KMS client setup**

### 3.2 Configuring CNG Client

The Fortanix KMS Server URL and proxy information are configured in the Windows registry for the local machine or the current user.

Run the following command to navigate to `FortanixKmsClientConfig.exe` file:

```bash
cd C:\Program Files\Fortanix\KMSClient\
```

The machine key store uses the local machine configuration, and the user key store uses the current user configuration. For example, run the following command to configure the Fortanix KMS Server URL for the local machine:

```bash
FortanixKmsClientConfig.exe machine --api-endpoint {KMS_URL}
```

Where,`KMS_URL` refers to the Fortanix DSM URL. On-premises customers use the KMS URL and SaaS. The customers can use the following URLs based on the region.

- Europe: [https://eu.smartkey.io/](https://eu.smartkey.io/)
- APAC: [https://apac.smartkey.io/](https://apac.smartkey.io/)
- United States of America: [https://amer.smartkey.io/](https://amer.smartkey.io/)

For example,

```bash
FortanixKmsClientConfig.exe machine --api-endpoint https://<fortanix_dsm_url>
```

Run the following command to configure the Fortanix KMS Server URL for the current user:

```bash
FortanixKmsClientConfig.exe user --api-endpoint {KMS_URL}
```

To configure proxy information, add `--proxy http://proxy.com` or `--proxy none` to unconfigure proxy.

## 4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 4.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(16).png)

**Figure 6: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 4.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Add_Group(13).png)

Figure 7: Add groups
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

The new group is added to the Fortanix DSM successfully.

### 4.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(60).png)

**Figure 8: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 4.3: Creating a Group*](/v1/docs/data-security-manager-with-microsoft-sql-server-tde-integration-before-you-begin#43-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

The new application is added to the Fortanix DSM successfully.

### 4.5 Copying the API Key

The SQL administrator requires permission to connect to Fortanix DSM to generate the key.

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 4.4: Creating an Application*](/v1/docs/data-security-manager-with-microsoft-sql-server-tde-integration-before-you-begin#44-creating-an-application) to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use it as the value for the `SECRET` parameter.

## 5.0 Reference Documents

For the step-by-step integration procedure, refer to the following articles in the same sequence as mentioned:

1. [Data Security Manager with Microsoft SQL TDE Integration - Standalone Server Integration](/v1/docs/data-security-manager-with-microsoft-sql-server-tde-integration-standalone-server)
2. [Data Security Manager with Microsoft SQL TDE Integration - AOG Server Integration](/v1/docs/data-security-manager-with-microsoft-sql-server-tde-integration-always-on-group-aog)
3. [Data Security Manager with Microsoft SQL TDE Integration - Key Rotation](/v1/docs/data-security-manager-with-microsoft-sql-server-tde-integration-key-rotation)
4. [Data Security Manager with Microsoft SQL TDE Integration - Backup & Restore](/v1/docs/data-security-manager-with-microsoft-sql-server-tde-integration-backup-restore)
5. [Data Security Manager with Microsoft SQL TDE Integration - Advanced](/v1/docs/data-security-manager-with-microsoft-sql-server-tde-integration-advanced)

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Fortanix DSM with Microsoft SQL Server TDE - Standalone Server](/fortanix-dsm-with-microsoft-sql-server-tde-integration-standalone-server.md)
- [Fortanix DSM with Microsoft SQL Server TDE - Introduction](/fortanix-dsm-with-microsoft-sql-server-tde-integration-introduction.md)
- [PKCS#11 Library](/fortanix-dsm-clients-pkcs11-library.md)
- [Fortanix DSM with Microsoft CNG Provider and SignTool](/using-fortanix-dsm-with-microsoft-cng-provider-and-signtool.md)