Azure SQL Encryption: TDE, Always Encrypted, and Masking

The four mechanisms protecting data at rest, in transit, and in use — what each one actually covers, why Always Encrypted needs a special client, and where dynamic data masking stops being a security control.