> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an application partition for Microsoft SQL Server Always Encrypted

> Procedural steps to create an application partition for isolating keys and permissions for SQL Server Always Encrypted.

To segregate applications on the HSM, you must create an application partition specifically for your use case. Application partitions segment the permissions and keys between applications on an HSM.

Choose one of the following methods to create an application partition:

## Excrypt Manager

Perform the following steps on Excrypt Manager to create an application partition:

<Steps>
  <Step>
    Go to the **Application** **Partitions** menu and select **\[ Add ]**.
  </Step>

  <Step>
    In the **Basic** **Information** tab, configure all of the fields as follows:

    <table>
      <thead>
        <tr>
          <th><em><strong>Option</strong></em></th>
          <th><em><strong>Required configuration</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Role Name</strong></td>
          <td>Specify any name that you would like for this new application partition.</td>
        </tr>

        <tr>
          <td><strong>Logins Required </strong></td>
          <td>Set to <strong>1</strong><Note>If the HSM is in FIPS mode, you must set Logins Required to 2.<br /></Note></td>
        </tr>

        <tr>
          <td><strong>Ports</strong></td>
          <td>Set to <strong>Prod</strong>.</td>
        </tr>

        <tr>
          <td><strong>Connection Sources</strong></td>
          <td>Set to <strong>Ethernet</strong>.</td>
        </tr>

        <tr>
          <td><strong>Managed Roles</strong></td>
          <td>Leave blank because you specify the exact Permissions, Key Slots, and Commands for this application partition or role to have access to.</td>
        </tr>

        <tr>
          <td><strong>Use Dual Factor</strong></td>
          <td>Set to <strong>Never</strong>.</td>
        </tr>

        <tr>
          <td><strong>Upgrade Permissions</strong></td>
          <td>Leave unchecked.</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    In the **Permissions** tab, select the following **key** permissions:

    <table>
      <thead>
        <tr>
          <th><em><strong>Permission</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Keys</strong></td>
          <td>Top-level permission</td>
        </tr>

        <tr>
          <td><strong>Authorized</strong></td>
          <td>Allows for keys that require login</td>
        </tr>

        <tr>
          <td><strong>Import</strong> <strong>PKI</strong> </td>
          <td>Allows trusting an external PKI. Generally not recommended, but some applications use this to enable PKI symmetric key wrapping.</td>
        </tr>

        <tr>
          <td><strong>No</strong> <strong>Usage</strong> <strong>Wrap</strong> </td>
          <td>Allows for interoperable key wrapping without defining key usage as part of the wrapped key. Use this only if you want to exchange keys with external entities or use the HSM to wrap externally used keys.</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    In the **Key** **Slots** tab, we recommend you create a range of 1000 total keys that do not overlap with another application partition. Within the specified range, you should have ranges for both symmetric and asymmetric keys. If the application requires more keys, configure it accordingly.
  </Step>

  <Step>
    To use the HSMs' functionality, you must enable particular functions on the application partition based on application requirements. Microsoft SQL Always Encrypted requires the following commands for operation. Enable the following commands in the **Commands** tab:

    **PKCS #11 Communication Commands**:

    <table>
      <thead>
        <tr>
          <th><em><strong>Command</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>ECHO</strong></td>
          <td>Communication Test/Retrieve Version</td>
        </tr>

        <tr>
          <td><strong>HASH</strong></td>
          <td>Retrieve device serial</td>
        </tr>

        <tr>
          <td><strong>GPKM</strong></td>
          <td>Retrieve key table information</td>
        </tr>

        <tr>
          <td><strong>GPKS</strong></td>
          <td>General-purpose key settings get/change</td>
        </tr>

        <tr>
          <td><strong>GPKR</strong></td>
          <td>General-purpose key settings get (read-only)</td>
        </tr>

        <tr>
          <td><strong>TIME</strong></td>
          <td>Get/Set the HSM Internal Clock</td>
        </tr>
      </tbody>
    </table>

    **Key Operations Commands**:

    <table>
      <thead>
        <tr>
          <th><em><strong>Command</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>GRSA</strong></td>
          <td>Generate RSA Private and Public Key</td>
        </tr>

        <tr>
          <td><strong>RPFP</strong></td>
          <td>Get public components from RSA private key</td>
        </tr>

        <tr>
          <td><strong>APFP</strong></td>
          <td>Get public components from ECC private key</td>
        </tr>
      </tbody>
    </table>

    **Data Encryption Commands**:

    <table>
      <thead>
        <tr>
          <th><em><strong>Command</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>GPSR</strong></td>
          <td>General-purpose RSA encrypt/decrypt or sign/verify with recovery</td>
        </tr>
      </tbody>
    </table>

    **Signing Commands**:

    <table>
      <thead>
        <tr>
          <th><em><strong>Command</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>RSAS</strong></td>
          <td>Generate a signature using a RSA private key</td>
        </tr>

        <tr>
          <td><strong>ASYS</strong></td>
          <td>Generate a signature using PKI private key</td>
        </tr>
      </tbody>
    </table>
  </Step>
</Steps>

## FXCLI

Run the following **role** FXCLI commands to create the new application partition and enable all required functions:

```shell title="FXCLI" expandable lines wrap theme={null}
  role add --name Role_Name --application --key-range (0,999) --perm "Keys:Authorized" --perm "Keys:Import PKI" --perm "Keys:No Usage Wrap"
```

```shell title="FXCLI" expandable lines wrap theme={null}
  role modify --name [role_name] --add-perm Excrypt:ECHO --add-perm Excrypt:HASH --add-perm Excrypt:GPKM --add-perm Excrypt:GPKS --add-perm Excrypt:GPKR --add-perm Excrypt:TIME --add-perm Excrypt:GRSA --add-perm Excrypt:RPFP --add-perm Excrypt:APFP --add-perm Excrypt:GPSR --add-perm Excrypt:RSAS --add-perm Excrypt:ASYS
```