An Azure SQL database uses Always Encrypted. What two items must you provide application developers so they can retrieve and decrypt the data?

For applications to decrypt data protected by Always Encrypted in an Azure SQL database, developers need access to both the column encryption key (CEK) and the column master key (CMK). The CEK is used to encrypt the actual data in the database columns, while the CMK is used to encrypt the CEK itself. The application uses the CMK to decrypt the CEK, and then uses the decrypted CEK to decrypt the data. Without both keys, the data remains encrypted and unreadable by the application. A stored access policy and a shared access signature (SAS) are used for controlling access to Azure Storage resources, not for decrypting Always Encrypted data in SQL databases. User credentials are for authentication to the database but do not provide the cryptographic keys needed for decryption.