Re: TDE/FDE, and AE. They use different paradigms. They aren't intended to be related.

TDE/FDE are protecting the server, and  loss of the physical assets. In this case, you...

Are all these dbs on the same instance? Or really, do they all use the same certificate to protect the DEK (databsae encryption key)? The DEK is in each TDE...

Hmmm, this is tricky. How did you set this up? I suspect that you really needed to restore the SMK from the primary onto the secondaries and then setup the...

Did you manually recreate them?

the error looks like you have a DMK in Azure without a password, which isn't allowed in an on-premise instance. I exported a DTA from Azure and imported into SQL...

Master guidance here: https://support.microsoft.com/en-us/help/4073225/guidance-for-sql-server

I'd concur with Evgeny, go with CU 7

The things I'd worry about with failover is strange behavior, or sending dup alerts. Maybe you read some data from master/msdb and load this into a table in your db,...

If this db is tightly bound to the user databases, maybe so. If not, it might warrant it's own AG. Either way, as Beatrix noted, if this depends on reading...

Ignore these stats. If they are useful and always created, you could drop them and recreate them with better names, but it's really not worth the effort.

Overall, this seems reasonable to me. I like separation of each server/instance to its own account and its own backups. Anyone logging into a server could run IE, and someone...

Added: https://www.sqlservercentral.com/Forums/Database-Design/Security-and-Auditing

There isn't a general "performance is worse" statement that I've seen, or that I think can be made. The impact is very workload dependent. It seems some of the other...