How do you grant a specific user or role permission to see the real, unmasked data despite dynamic data masking being applied?

Intermediate

Answer

You grant the UNMASK permission to a specific user or role, either at the database level to allow them to see all masked columns, or in more recent versions, at a more granular column level, letting only trusted individuals like database administrators or compliance officers view the actual sensitive values.

GRANT UNMASK TO ComplianceOfficer;

Real-world example A financial company grants the UNMASK permission only to its compliance team, ensuring that regular customer service staff continue to see masked sensitive data while auditors can view the real values when legally required.

Common follow-ups: What is the difference between database level and column level UNMASK permission?;Does having the db_owner role automatically grant UNMASK permission?

SQL Server Security & Permissions;Data Types & Schema Design

All 7 Dynamic Data Masking questions