County child-services adjacent case tables require a durable record of who read sensitive rows. Which capability should the team enable?

SQL auditing that captures SELECT activity against the sensitive case tables provides the durable record county child-services teams need of who read sensitive rows. Audit specifications or Azure SQL auditing can record the principal name, action time, statement class, and success or failure for reads against designated objects, creating evidence for investigations and compliance reviews. This accountability trail is distinct from limiting what appears on screen. Dynamic Data Masking alone without access logging fails because masking changes presentation for non-privileged callers but does not prove who queried which case rows. Columnstore indexes optimize analytical scan performance; they are not security monitoring and cannot replace audit events. Disabling Query Store to reduce audit noise confuses a performance plan repository with security auditing and removes useful regression data without creating an access log. Exam caveat: Scope auditing carefully, since auditing every database action can generate high volume; omitting SELECT activity on sensitive case tables, however, misses the required evidence. Auditing answers who did what, while masking addresses what callers see. Operational check: Enable Azure SQL auditing or SQL Server audit to a secured Log Analytics workspace or storage account, include SELECT on the sensitive case schemas, and run a controlled read as a test caseworker identity. Verify the record shows that principal and object. Restrict who can disable auditing, align retention with child-services policy, alert on audit configuration changes, and periodically sample events during compliance drills. Pairing auditing with SIEM retention can complete the compliance story.