Hiding sensitive column values behind a dynamic mask

Dynamic data masking (DDM) obscures sensitive data in query results for non-privileged users while leaving the underlying data in storage unchanged. It is applied at the column level on tables in a SQL analytics endpoint or Warehouse in Microsoft Fabric, using built-in masking functions to control how much of the data is exposed.

1 · Learn the must-know

• 1DDM works on Fabric Warehouse tables and SQL analytics endpoint tables (Lakehouse), configured via T-SQL (ADD MASKED WITH) or through the Fabric portal UI on the column.
• 2Available masking functions include default() (fully masks based on data type), email() (masks email format, e.g. [email protected]), random() (numeric range masking), and partial() (custom prefix/padding/suffix exposure).
• 3Masking is enforced at query time only: it does not encrypt data at rest, and users with sufficient permission (e.g., UNMASK permission or admin/workspace roles) can bypass the mask and see plaintext.
• 4By default, workspace admins and members with elevated roles can see unmasked data unless explicitly restricted; masking is not a substitute for proper access control or encryption.
• 5Masking rules are simple obfuscation and can potentially be inferred/bypassed via inference attacks (e.g., brute-forcing ranges or using WHERE clauses), so it should be combined with other security layers like row-level security and object-level permissions.
• 6DDM policies must be created/altered via T-SQL or the portal by users with ALTER ANY MASK permission, and grants/revokes of UNMASK permission control who sees the real values.

2 · Check your understanding