Explanation
The following permissions are necessary to perform column-level encryption, or cell-level encryption.
* CONTROL permission on the database.
* CREATE CERTIFICATE permission on the database. Only Windows logins, SQL Server logins, and application roles can own certificates. Groups and roles cannot own certificates.
* ALTER permission on the table.
* Some permission on the key and must not have been denied VIEW DEFINITION permission.
References:
https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/encrypt-a-column-of-data