Visual Studio Team Services Encryption at Rest

This post details the adoption of Azure SQL Database Transparent Data Encryption (TDE) and Azure Storage Service Encryption (SSE) for data at rest in Visual Studio Team Services (VSTS). TDE encrypts data in SQL databases (work items, version control metadata, build metadata), while SSE encrypts data in Azure Storage blobs (attachments, version control files, build logs). Remaining work includes encrypting secondary data storage on VM disks (caches, index files, build/release data) using Azure Disk Encryption (ADE) where possible, and migrating PaaS VMs to IaaS VMs. Encryption for Azure Storage Tables (package management, cloud load testing metadata) is also planned.