1. No—Always Encrypted is a feature of Azure SQL Database and SQL Server, which encrypts data that is stored in a database table.
2. Yes—you can use the Key Vault API to create a self-signed certificate.
3. No—all Azure storage services support server-side encryption at rest. This also includes Queue Storage.