Merge pull request #100937 from kummanish/master

Adding new content for data encryption

Author: PRMerger9

articles/mysql/howto-data-encryption-portal.md

@@ -10,12 +10,11 @@ ms.date: 01/10/2020
 
 # Data Encryption for Azure Database for MySQL server using Azure portal
 
-In this article, you will learn how to set up and manage to use the Azure portal to setup Data Encryption for your Azure Database for MySQL.
+In this article, you will learn how to set up and manage to use the Azure portal to set up Data Encryption for your Azure Database for MySQL.
 
-## Prerequisites for PowerShell
+## Prerequisites for CLI
 
 * You must have an Azure subscription and be an administrator on that subscription.
-* You must have Azure PowerShell installed and running.
 * Create an Azure Key Vault and Key to use for customer-managed key.
 * The Key Vault must have the following property to use as a customer-managed key
     * [Soft Delete](https://docs.microsoft.com/azure/key-vault/key-vault-ovw-soft-delete)
@@ -40,7 +39,7 @@ In this article, you will learn how to set up and manage to use the Azure portal
 
    ![Access policy overview](media/concepts-data-access-and-security-data-encryption/show-access-policy-overview.png)
 
-2. Select the **Key Permissions** select **Get**, **Wrap**, **Unwrap** and the **Principal** which is the name of the MySQL server.
+2. Select the **Key Permissions** select **Get**, **Wrap**, **Unwrap** and the **Principal**, which is the name of the MySQL server. If your server principal can't be found in the list of existing principals, you will need to register it by attempting to set up Data Encryption for the first time, which will fail.
 
    ![Access policy overview](media/concepts-data-access-and-security-data-encryption/access-policy-warp-unwrap.png)
 
@@ -58,9 +57,9 @@ In this article, you will learn how to set up and manage to use the Azure portal
 
 3. **Save** the settings.
 
-4. To ensure all files (including temp files) are full encrypted, a server restart is required.
+4. To ensure all files (including **temp files**) are full encrypted, a server **restart** is **required**.
 
-## Restoring or creating replica of the server which has Data Encryption enabled
+## Restoring or creating replica of the server, which has Data Encryption enabled
 
 Once an Azure Database for MySQL is encrypted with customer's managed key stored in the Key Vault, any newly created copy of the server either though local or geo-restore operation or a replica (local/cross-region) operation. So for an encrypted MySQL server, you can follow the steps below to create an encrypted restored server.
 
@@ -76,17 +75,19 @@ Once an Azure Database for MySQL is encrypted with customer's managed key stored
 
    ![Mark server inaccessible](media/concepts-data-access-and-security-data-encryption/show-restore-data-encryption.png)
 
-3. To fix Inaccessible state, you need to revalidate the key on the restored server.
+3. To fix Inaccessible state, you need to revalidate the key on the restored server. Click on the **Data Encryption** blade and then the **Revalidate key** button.
+
+   > [!NOTE]
+   > The first attempt to revalidate will fail since the new server's service principal needs to be given access to the key vault. To generate the service principal click on **Revalidate key**, which will give error but generates the service principal. Thereafter, refer to steps [in section 2](https://docs.microsoft.com/azure/mysql/howto-data-encryption-portal#setting-the-right-permissions-for-key-operations) above.
 
    ![revalidate server](media/concepts-data-access-and-security-data-encryption/show-revalidate-data-encryption.png)
 
    You will have to give access to the new server to the Key Vault. 
 
-4. Once you revalidate the key, the server resumes its normal functionality.
+4. After registering the service principal, you will need to revalidate the key again and the server resumes its normal functionality.
 
    ![Normal server restored](media/concepts-data-access-and-security-data-encryption/restore-successful.png)
 
-
 ## Next steps
 
  To learn more about Data Encryption, see [what is Azure data encryption](concepts-data-encryption-mysql.md).

articles/postgresql/howto-data-encryption-portal.md

@@ -12,10 +12,9 @@ ms.date: 01/10/2020
 
 In this article, you will learn how to set up and manage to use the Azure portal to set up Data Encryption for your Azure Database for PostgreSQL Single server.
 
-## Prerequisites for PowerShell
+## Prerequisites for CLI
 
 * You must have an Azure subscription and be an administrator on that subscription.
-* You must have Azure PowerShell installed and running.
 * Create an Azure Key Vault and Key to use for customer-managed key.
 * The Key vault must have the following property to use as a customer-managed key
     * [Soft Delete](https://docs.microsoft.com/azure/key-vault/key-vault-ovw-soft-delete)
@@ -41,7 +40,7 @@ In this article, you will learn how to set up and manage to use the Azure portal
 
    ![Access policy overview](media/concepts-data-access-and-security-data-encryption/show-access-policy-overview.png)
 
-2. Under the **Key Permissions** select **Get**, **Wrap**, **Unwrap** and the **Principal** which is the name of the PostgreSQL server.
+2. Under the **Key Permissions** select **Get**, **Wrap**, **Unwrap** and the **Principal**, which is the name of the PostgreSQL server. If your server principal can't be found in the list of existing principals, you will need to register it by attempting to set up Data Encryption for the first time, which will fail.  
 
    ![Access policy overview](media/concepts-data-access-and-security-data-encryption/access-policy-warp-unwrap.png)
 
@@ -59,9 +58,9 @@ In this article, you will learn how to set up and manage to use the Azure portal
 
 3. **Save** the settings.
 
-4. To ensure all files (including temp files) are full encrypted, a server restart is required.
+4. To ensure all files (including **temp files**) are full encrypted, a server **restart** is **required**.
 
-## Restoring or creating replica of the server which has data encryption enabled
+## Restoring or creating replica of the server, which has data encryption enabled
 
 Once an Azure Database for PostgreSQL Single server is encrypted with customer's managed key stored in the Key Vault, any newly created copy of the server either though local or geo-restore operation or a replica (local/cross-region) operation. So for an encrypted PostgreSQL server, you can follow the steps below to create an encrypted restored server.
 
@@ -78,17 +77,19 @@ Once an Azure Database for PostgreSQL Single server is encrypted with customer's
    ![Mark server inaccessible](media/concepts-data-access-and-security-data-encryption/show-restore-data-encryption.png)
 
 
-3. To fix Inaccessible state, you need to revalidate the key on the restored server.
+3. To fix Inaccessible state, you need to revalidate the key on the restored server. Click on the **Data Encryption** blade and then the **Revalidate key** button.
+
+   > [!NOTE]
+   > The first attempt to revalidate will fail since the new server's service principal needs to be given access to the key vault. To generate the service principal click on **Revalidate key**, which will give error but generates the service principal. Thereafter, refer to steps [in section 2](https://docs.microsoft.com/azure/postgresql/howto-data-encryption-portal#setting-the-right-permissions-for-key-operations) above.
 
    ![revalidate server](media/concepts-data-access-and-security-data-encryption/show-revalidate-data-encryption.png)
 
    You will have to give access to the new server to the Key Vault. 
 
-4. Once you revalidate the key, the server resumes its normal functionality.
+4. After registering the service principal, you will need to revalidate the key again and the server resumes its normal functionality.
 
    ![Normal server restored](media/concepts-data-access-and-security-data-encryption/restore-successful.png)
 
-
 ## Next steps
 
  To learn more about Data Encryption, see [what is Azure data encryption](concepts-data-encryption-postgresql.md).