{
   "name": "deny-sql-db-tde-disabled",
   "properties": {
      "displayName": "Deny SQL database transparent data encryption disablement",
      "description": "Deny the ability to disable transparent data encryption status for SQL databases",
      "mode": "All",
      "parameters": {},
      "policyRule": {
         "if": {
            "allOf": [
               {
                  "field": "type",
                  "equals": "Microsoft.SQL/servers/databases/transparentDataEncryption"
               },
               {
                  "field": "Microsoft.Sql/transparentDataEncryption.status",
                  "notEquals": "enabled"
               }
            ]
         },
         "then": {
            "effect": "deny"
         }
      }
   }
}