The AZ-500 exam has been retired
It was retired on August 31, 2026. It was replaced by SC-500 (Microsoft Cloud and AI Security Engineer). Go to the SC-500 study guide →
Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
4.3.3. Dynamic Data Masking
💡 First Principle: Dynamic Data Masking (DDM) obscures sensitive data in query results without modifying stored data. Users with UNMASK permission see original values; others see masked values.
Scenario: Customer support representatives need to access customer records but shouldn't see full credit card numbers.
Masking Functions
| Function | Use Case | Example Output |
|---|---|---|
| default() | Full masking | "xxxx", 0, 01-01-1900 |
| email() | Email addresses | "aXXX@XXXX.com" |
| random(start, end) | Numeric obfuscation | Random number |
| partial(prefix, padding, suffix) | Partial reveal | "XXXX-XXXX-XXXX-1234" |
Implementing Masking
-- Add mask to credit card column
ALTER TABLE Customers
ALTER COLUMN CreditCard ADD MASKED WITH (FUNCTION = 'partial(0,"XXXX-XXXX-XXXX-",4)');
-- Grant unmask permission
GRANT UNMASK TO [FinanceTeam];
⚠️ Exam Trap: Using default() for credit card masking. Default masking hides all digits, making verification impossible. Use partial(0,"XXXX-XXXX-XXXX-",4) to show the last 4 digits—the industry standard.
Enroll to unlock the 6 practice questions written for this section, so you can test what you just read while it is fresh.
Enroll to unlock the 1 flashcard for this section and review them on a spaced-repetition schedule.
Written byAlvin Varughese
Founder•20 professional certifications