Verify client-side encryption with Always Encrypted can be used

[danielmarbach]

More details about the feature

At first glance, initializing the client should work by specifying the key resolver and taking control over the client creation:

var tokenCredential = new DefaultAzureCredential();
var keyResolver = new KeyResolver(tokenCredential);
var client = new CosmosClient("<connection-string>")
    .WithEncryption(keyResolver, KeyEncryptionKeyResolverName.AzureKeyVault);

container level encryption policies are currently not considered when running installers because there is no way to take control over the installation process when installers run with EnableInstallers. The sane way to do this is probably to disable installers and create the table with other means. Reading and writing encrypted data should then happen automatically.

There might be caveats with filter queries on encrypted properties, see https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-always-encrypted?tabs=dotnet#filter-queries-on-encrypted-properties