Tested on SQL Server 2022, October 2026: backup encryption end to end (including restoring on a server without the certificate), and backup to URL (credential, backup, verify, restore, encrypted and striped backups) against Microsoft’s Azure storage emulator. Not yet tried against a real Azure storage account.

Backup encryption

Native backup encryption (SQL Server 2014 onwards) encrypts the backup file with a certificate held in master. Without that certificate and its private key, the backup cannot be restored anywhere, so back the certificate up first and store it separately from the backups, just as for TDE.

Step 1: master key and certificate (once per server):

USE master;
-- Skip the CREATE MASTER KEY if this returns a row
SELECT name FROM sys.symmetric_keys WHERE name = N'##MS_DatabaseMasterKey##';

CREATE MASTER KEY ENCRYPTION BY PASSWORD = N'<your password here>';

CREATE CERTIFICATE BackupCert
WITH SUBJECT = N'Backup encryption certificate',
     EXPIRY_DATE = '2036-12-31';

BACKUP CERTIFICATE BackupCert
TO FILE = N'\\SafeShare\Certs\BackupCert.cer'
WITH PRIVATE KEY (FILE = N'\\SafeShare\Certs\BackupCert.pvk',
                  ENCRYPTION BY PASSWORD = N'<your password here>');

Keep both passwords in the password vault.

Step 2: take an encrypted backup:

BACKUP DATABASE [YourDB]
TO DISK = N'\\BackupServer\SQLBackups\YourDB\YourDB_FULL_20261004.bak'
WITH COMPRESSION, CHECKSUM, STATS = 10,
     ENCRYPTION (ALGORITHM = AES_256, SERVER CERTIFICATE = BackupCert);

Step 3: to restore on another server, recreate the certificate there first, then restore as normal:

USE master;
CREATE MASTER KEY ENCRYPTION BY PASSWORD = N'<your password here>';   -- if none exists
CREATE CERTIFICATE BackupCert
FROM FILE = N'\\SafeShare\Certs\BackupCert.cer'
WITH PRIVATE KEY (FILE = N'\\SafeShare\Certs\BackupCert.pvk',
                  DECRYPTION BY PASSWORD = N'<your password here>');

Which recent backups are encrypted:

SELECT TOP (20) database_name, backup_finish_date, type,
       key_algorithm, encryptor_type
FROM msdb.dbo.backupset
ORDER BY backup_finish_date DESC;

Backup to URL (Azure Blob Storage)

SQL Server 2016 onwards can back up straight to an Azure storage container using a shared access signature (SAS).

Step 1: a credential named exactly after the container URL:

CREATE CREDENTIAL [https://youraccount.blob.core.windows.net/sqlbackups]
WITH IDENTITY = N'SHARED ACCESS SIGNATURE',
     SECRET = N'<SAS token without the leading ?>';

Step 2: back up and verify:

BACKUP DATABASE [YourDB]
TO URL = N'https://youraccount.blob.core.windows.net/sqlbackups/YourDB_FULL_20261004.bak'
WITH COMPRESSION, CHECKSUM, STATS = 10;

RESTORE VERIFYONLY
FROM URL = N'https://youraccount.blob.core.windows.net/sqlbackups/YourDB_FULL_20261004.bak';

Restores use FROM URL in the same way. Encryption works with URL backups too: add the ENCRYPTION option.

For large databases, stripe the backup across several URLs (TO URL = N’…part1.bak’, URL = N’…part2.bak’, and so on) and add MAXTRANSFERSIZE = 4194304, BLOCKSIZE = 65536. A single blob has a size limit, and striping also makes the backup faster.

Watch out for

• A SAS token has an expiry date. When it lapses every backup fails, so diarise the renewal and alert on backup job failures.
• The credential name must match the container URL exactly, including https:// and with no trailing slash.
• Restoring from Azure costs money for data leaving the storage account, and takes as long as your bandwidth allows. Test a full restore before you depend on it.
• Losing the backup certificate means losing the backups. Test restoring an encrypted backup on a different server at least once.

From my SQL Server DBA handbook.