A 311 operations desk wants resident phone numbers partially obscured on agent screens without rewriting the intake application. Which feature should they configure?

Dynamic Data Masking on phone columns for non-privileged roles is appropriate when a 311 operations desk needs resident phone numbers partially obscured on agent screens without rewriting the intake application. Masking rules affect result-set presentation for callers lacking UNMASK permission, so agents can see enough to work a ticket while selected digits remain hidden. The application can continue querying the same tables and columns, requiring no client rewrite. Always Encrypted with enclave computations addresses a different need: it protects plaintext from the database engine and can require key and driver changes, complicating lookups rather than simply masking digits on the screen. Row-Level Security predicates that hide entire request rows remove operational tickets from agents’ view instead of masking one phone attribute, disrupting queue work. Dropping the phone column and storing numbers in free-text comments sacrifices structured data quality, defeats masking and indexing, and can expose numbers in unstructured fields. Exam caveat: Dynamic Data Masking is presentation control, not encryption; privileged roles with UNMASK, table owners, or applications using elevated identities can still see clear values, and the data remains plaintext at rest. Practical check: define a masking function on resident phone columns, give agent roles no UNMASK permission, and verify partial masking in the UI while a privileged compliance account sees full values for legitimate escalation. Confirm the intake app uses a least-privilege SQL principal and that ad hoc reporting accounts lack UNMASK; document which municipal roles may see full phone values.