After dynamic data masking is applied, the lock-lab DBA still sees plaintext while analysts see masked emails. How should you let a specific support lead see real values without removing the mask?
Select an answer to reveal the explanation.
Short Explanation
Masking isn’t a DBA force field—dbo and UNMASK still see clear text. Hand UNMASK to the few people who truly need the real email, and leave the sunglasses on for everyone else.
Full Explanation
Callers with UNMASK (and highly privileged roles such as dbo) can see unmasked values even when dynamic data masking is configured. Grant UNMASK selectively rather than removing the mask for all users. TDE and Key Vault roles do not control SQL dynamic masking visibility. Masking alone is not a DBA-proof confidentiality boundary; Always Encrypted addresses untrusted high-privilege server users.