Skip to main content

Mask columns with a masking policy

A masking policy hides the values of a sensitive column from the people you choose, while they keep querying the rest of the table. The data stored in the table does not change.

Prerequisites​

  • Your role includes governance:masking_policies:write. The portal_admin and policy_manager roles have it. See Portal roles and permissions.
  • The people in the policy already have SELECT on the table through an access policy.

Create a masking policy​

  1. In the left sidebar, select Data Security → Security policies, then open the Masking tab.
  2. Select Create policy.
  3. Enter a Policy name and, optionally, a Description.
  4. Add the people who must not see the real values in User, Group, or Service Account. Add at least one.
  5. Select the Catalog, Schema, Table, and Column. A policy covers one column.
  6. Select a Masking option.
  7. Keep Active selected.
  8. Select Create.

Permission is always SELECT and cannot be changed. To mask several columns, create one policy for each column.

Create masking policy form with a column and a masking option selected

About 1 minute later, the people in the policy see the masked values in Query Editor, in sample data in Data Explorer, and in connected tools.

Masking options​

Masking optionWhat people seeUse it for
HashA hash of the value. The same value always gives the same hash.Columns people still need to join or count on, such as customer IDs.
MaskThe value with its characters replaced.Text people must not read at all.
NullAn empty value (NULL).Columns people do not need.
Show Last 4Only the last 4 characters. Text columns only.Phone numbers, card numbers, account numbers.

Good to know​

  • Masking is for people who may query the table but not see one column. To hide the whole table, leave the people out of the access policy instead.
  • If several masking policies apply to the same person and column, you cannot choose which one wins. Use one masking policy per column and group.

If an action fails​

MessageWhat it meansWhat to do
The selected masking type is not valid for this column.The option does not fit the column type, for example Show Last 4 on a number column.Choose another option, such as Hash or Null.
The change could not be applied. No permission was updated.Nothing was saved. Your entries are kept.Select Create again. If it keeps failing, contact support.

Next steps​