How to Mask Phone in Fabric Warehouse for Group1 Only?
HOTSPOT
You have a Fabric warehouse named Warehouse1 that contains a table named Table1. Table1 contains the following columns that store string values:
• FirstName
• Phone
• Email
You have two Microsoft Entra security groups named Group1 and Group2. The members of both groups can query Table1 and see full values for FirstName, Phone, and Email.
You need to configure Table1 to meet the following requirements:
• The members of Group1 must see masked values for Phone, showing only the last three characters of each phone number.
• The Group1 members must see unmasked values for FirstName.
• The members of Group2 must see unmasked values for all the columns.
• The solution must use Fabric warehouse-supported permissions and T-SQL.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Community Insight
Tests T-SQL dynamic data masking plus UNMASK grant scope in a Fabric warehouse; the trap is granting UNMASK too broadly at database level, which also unmasks Phone for Group1.
Fabric Warehouse dynamic data masking hides column values unless a principal holds UNMASK. This page establishes that Phone receives a partial(0,"XXX",3) mask while Group2 receives table-level UNMASK and Group1 remains masked.
Granting UNMASK on the whole database or to both security groups, or masking FirstName and Email as well, which breaks the requirement that Group1 sees those columns unmasked.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Fabric Warehouse supports T-SQL dynamic data masking through ALTER TABLE... ALTER COLUMN... ADD MASKED WITH, so Phone can be masked directly on Table1. The partial(0,"XXX",3) function replaces every character except the last three, which matches the Group1 requirement to see only the final three digits of each phone number. FirstName and Email are never masked, so Group1 reads them in full without any extra grant. Group2 receives UNMASK on Table1 at table scope; because UNMASK is present, Group2 bypasses the Phone mask while Group1, lacking UNMASK, continues to see masked Phone values. This uses only Fabric warehouse-supported permissions and T-SQL, satisfying the stated constraints.Why Other Candidate Answers Are Wrong
Granting UNMASK at the database level is over-permissive: it would let Group1 see the full Phone value, defeating the masking requirement. Granting UNMASK to Group1 on Phone is the wrong direction entirely, because Group1 must remain masked while Group2 is the unmasked audience. Masking FirstName or Email violates the explicit requirement that Group1 see those columns unmasked, and adding those masks would force unnecessary column-level exceptions. Using row-level security or column-level security instead of dynamic data masking changes which rows or columns are visible but does not produce the last-three-characters Phone masking behavior required here.Community Comment Notes
As nnnnate noted, the masking itself works, but the UNMASK grant scope matters: a database-level grant is broader than necessary, and "On Table would have been the better option." That aligns with granting UNMASK on Table1 specifically to Group2 rather than to the warehouse or database. The comment reinforces the exam point that permission scope, not just the mask function, determines whether Group1 accidentally sees full Phone values.Official Reference
Exam Strategy
Separate the two decisions: the mask function belongs on the Phone column, while UNMASK belongs only to Group2 at the narrowest scope that satisfies the requirement. Read the permission scope options carefully, because a database-level UNMASK looks similar to a table-level one but changes Group1's result.
Frequently Asked Questions
Does Fabric Warehouse support T-SQL dynamic data masking on a table column?
Yes. Fabric Warehouse supports T-SQL dynamic data masking, so you can use ALTER TABLE Table1 ALTER COLUMN Phone ADD MASKED WITH to apply a partial mask.
Why grant UNMASK to Group2 on Table1 instead of the database?
Table-level UNMASK gives Group2 unmasked values without also letting Group1 see full Phone values; a database-level grant would be broader than the requirement allows.