Prior to Sitecore 9, TDE could be used to configure data-at-rest encryption. Always Encrypted was introduced in SQL Server 2016, thus TDE was the only option for data-at-rest encryption and SSL for data-in-motion.
Always Encrypted is available in SQL Server 2016 (13.x) and SQL
Database. (Prior to SQL Server 2016 (13.x) SP1, Always Encrypted was
limited to the Enterprise Edition.)
Sitecore 9 supports SQL Server 2016 SP 1 and Always Encrypted support was added as data-at-rest encryption approach. Encryption can be configured just for columns with sensitive data. The performance for all other data will not be affected.
Both, SQL Server and SQL Provider has to be configured to support Always Encrypted.
Below you can find required encryption type per column with sensitive data.
It's also required to enable always encrypted in the sc.Xdb.Collection.Data.Sql.xml configuration file in all the roles:
It's optional feature. As far as, Sitecore 9 uses sharded clusters with multiple shards, all the shards have to be configured individually. If you need more details, I can provide them.
TDE can be configured as well. There is no official documentation that states that TDE is supported, but all the databases in PaaS are deployed with TDE enabled by default.
Always Encrypted can be configured just for the 'collection' db. All other dbs do not support it.