Why should you care?

Support staff may need to see that an email exists without reading the full address.

See it live — copy this example

Run in SQL Server Management Studio (SSMS) or Azure Data Studio.

USE DataVerse;
ALTER TABLE dbo.Customers
ALTER COLUMN Email ADD MASKED WITH (FUNCTION = 'email()');
CREATE USER mask_demo WITHOUT LOGIN;
GRANT SELECT ON dbo.Customers TO mask_demo;
EXECUTE AS USER = 'mask_demo';
SELECT CustomerId, Email FROM dbo.Customers;
REVERT;
DROP USER mask_demo;
-- Remove mask later: ALTER TABLE … ALTER COLUMN Email DROP MASKED;

What happened?

• email() mask obfuscates addresses for mask_demo.
• Privileged users still see real values.
• Storage remains unmasked.

Practice next

1. Apply the email mask.
2. SELECT as mask_demo and as yourself.
3. Try partial masks (partial()) on phone columns.
4. MASKED WITH (FUNCTION = 'default()') on FullName.
5. GRANT UNMASK TO a elevated support role only.

Remember

Masking obfuscates query results. Data at rest unchanged. Complement — not replace — encryption.

Support sees masked email

DataVerse support role reads Customers with email masks.

Outcome: Tickets proceed without full PII exposure.