Skip to content

Commit a36a537

Browse files
WilliamDAssafMSFTWilliamDAssafMSFT
committed
20250616 freshness pass
1 parent d060225 commit a36a537

11 files changed

+113
-106
lines changed

‎azure-sql/database/dynamic-data-masking-configure-portal.md

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,56 @@
11
---
2-
title: "Azure portal: Dynamic data masking"
3-
description: How to get started with Azure SQL Database dynamic data masking in the Azure portal
4-
author: Madhumitatripathy
5-
ms.author: matripathy
6-
ms.reviewer: wiassaf, vanto, mathoma
7-
ms.date: 04/05/2022
2+
title: "Dynamic Data Masking"
3+
description: How to get started with Azure SQL Database dynamic data masking in the Azure portal.
4+
author: WilliamDAssafMSFT
5+
ms.author: wiassaf
6+
ms.reviewer: matripathy, vanto, mathoma
7+
ms.date: 06/13/2025
88
ms.service: azure-sql-database
99
ms.subservice: security
1010
ms.topic: how-to
11-
ms.custom: sqldbrb=1
11+
ms.custom:
12+
- sqldbrb=1
13+
monikerRange: "=azuresql || =azuresql-db "
1214
---
1315
# Get started with SQL Database dynamic data masking with the Azure portal
16+
1417
[!INCLUDE[appliesto-sqldb](../includes/appliesto-sqldb.md)]
1518

16-
This article shows you how to implement [dynamic data masking](dynamic-data-masking-overview.md) with the Azure portal. You can also implement dynamic data masking using [Azure SQL Database cmdlets](/powershell/module/az.sql/) or the [REST API](/rest/api/sql/).
19+
This article shows you how to implement [dynamic data masking](dynamic-data-masking-overview.md) with the Azure portal. You can also implement dynamic data masking using [Azure SQL Database PowerShell cmdlets](/powershell/module/az.sql/) or the [REST API](/rest/api/sql/).
1720

1821
> [!NOTE]
19-
> This feature cannot be set using portal for SQL Managed Instance (use PowerShell or REST API). For more information, see [Dynamic Data Masking](/sql/relational-databases/security/dynamic-data-masking).
22+
> This feature cannot be set using the Azure portal for Azure SQL Managed Instance (use PowerShell or REST API). For more information, see [Dynamic Data Masking](/azure/azure-sql/database/dynamic-data-masking-overview?view=azuresql-mi&preserve-view=true).
2023
2124
## Enable dynamic data masking
2225

2326
1. Launch the Azure portal at [https://portal.azure.com](https://portal.azure.com).
24-
2. Go to your database resource in the Azure portal.
25-
3. Select the **Dynamic Data Masking** pane under the **Security** section.
26-
27-
![Screenshot that shows the Security section with Dynamic Data Masking highlighted.](./media/dynamic-data-masking-configure-portal/dynamic-data-masking-in-portal.png)
28-
29-
4. In the **Dynamic Data Masking** configuration page, you may see some database columns that the recommendations engine has flagged for masking. In order to accept the recommendations, just click **Add Mask** for one or more columns and a mask is created based on the default type for this column. You can change the masking function by clicking on the masking rule and editing the masking field format to a different format of your choice. Be sure to click **Save** to save your settings.
27+
1. Go to your database resource in the Azure portal.
28+
1. Under the **Security** section, select **Dynamic Data Masking**.
29+
1. In the **Dynamic Data Masking** configuration page, you might see some database columns that the recommendations engine has flagged for masking. In order to accept the recommendations, select **Add Mask** for one or more columns, and a mask is created based on the default type for this column. You can change the masking function by selecting on the masking rule and editing the masking field format to a different format of your choice. Select **Save** to save your settings. In the following screenshot, you can see recommended dynamic data masks for the sample `AdventureWorksLT` database.
3030

31-
![Screenshot that shows the Dynamic Data Masking configuration page.](./media/dynamic-data-masking-configure-portal/5_ddm_recommendations.png)
31+
:::image type="content" source="media/dynamic-data-masking-configure-portal/recommendations.png" alt-text="Screenshot that shows the Dynamic Data Masking configuration page, based on the AdventureWorksLT sample database." lightbox="media/dynamic-data-masking-configure-portal/recommendations.png":::
3232

33-
5. To add a mask for any column in your database, at the top of the **Dynamic Data Masking** configuration page, click **Add Mask** to open the **Add Masking Rule** configuration page.
33+
1. To add a mask for any column in your database, at the top of the **Dynamic Data Masking** configuration page, select **Add Mask** to open the **Add Masking Rule** configuration page.
3434

35-
![Screenshot that shows the Add Masking Rule configuration page.](./media/dynamic-data-masking-configure-portal/6_ddm_add_mask.png)
35+
:::image type="content" source="media/dynamic-data-masking-configure-portal/add-mask.png" alt-text="Screenshot that shows the Add Masking Rule configuration page." lightbox="media/dynamic-data-masking-configure-portal/add-mask.png":::
3636

37-
6. Select the **Schema**, **Table** and **Column** to define the designated field for masking.
38-
7. **Select how to mask** from the list of sensitive data masking categories.
37+
1. Select the **Schema**, **Table** and **Column** to define the designated field for masking.
38+
1. **Select how to mask** from the list of sensitive data masking categories.
3939

40-
![Screenshot that shows the sensitive data masking categories under the Select how to mask section.](./media/dynamic-data-masking-configure-portal/7_ddm_mask_field_format.png)
40+
:::image type="content" source="media/dynamic-data-masking-configure-portal/mask-field-format.png" alt-text="Screenshot that shows the sensitive data masking categories under the Select how to mask section." lightbox="media/dynamic-data-masking-configure-portal/mask-field-format.png":::
4141

42-
8. Click **Add** in the data masking rule page to update the set of masking rules in the dynamic data masking policy.
43-
9. Type the SQL authenticated users or authenticated identities from Microsoft Entra ID ([formerly Azure Active Directory](/entra/fundamentals/new-name)) that should be excluded from masking, and have access to the unmasked sensitive data. This should be a semicolon-separated list of users. Users with administrator privileges always have access to the original unmasked data.
42+
1. Select **Add** in the data masking rule page to update the set of masking rules in the dynamic data masking policy.
43+
1. Type the SQL authenticated users or authenticated identities from Microsoft Entra ID ([formerly Azure Active Directory](/entra/fundamentals/new-name)) that should be excluded from masking, and have access to the unmasked sensitive data. This should be a semicolon-separated list of users. Users with administrator privileges always have access to the original unmasked data.
4444

45-
![Navigation pane](./media/dynamic-data-masking-configure-portal/8_ddm_excluded_users.png)
45+
:::image type="content" source="media/dynamic-data-masking-configure-portal/excluded-users.png" alt-text="Screenshot from the Azure portal of the SQL users excluded from masking (administrators are always excluded) list box.":::
4646

4747
> [!TIP]
4848
> To make it so the application layer can display sensitive data for application privileged users, add the SQL user or Microsoft Entra identity the application uses to query the database. It is highly recommended that this list contain a minimal number of privileged users to minimize exposure of the sensitive data.
4949
50-
10. Click **Save** in the data masking configuration page to save the new or updated masking policy.
50+
1. Select **Save** in the data masking configuration page to save the new or updated masking policy.
5151

52-
## Next steps
52+
## Related content
5353

54-
- For an overview of dynamic data masking, see [dynamic data masking](dynamic-data-masking-overview.md).
55-
- You can also implement dynamic data masking using [Azure SQL Database cmdlets](/powershell/module/az.sql/) or the [REST API](/rest/api/sql/).
54+
- [Dynamic data masking](dynamic-data-masking-overview.md)
55+
- [Azure SQL Database PowerShell cmdlets](/powershell/module/az.sql/)
56+
- [REST API](/rest/api/sql/)

‎azure-sql/database/elastic-convert-to-use-elastic-tools.md

Lines changed: 36 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,31 @@
11
---
2-
title: Migrate existing databases to scale out
2+
title: Migrate Existing Databases to Scale Out
33
description: Convert sharded databases to use Elastic Database tools by creating a shard map manager
4-
author: scoriani
5-
ms.author: scoriani
6-
ms.reviewer: wiassaf, mathoma
7-
ms.date: 01/25/2019
4+
author: WilliamDAssafMSFT
5+
ms.author: wiassaf
6+
ms.reviewer: scoriani, mathoma
7+
ms.date: 06/13/2025
88
ms.service: azure-sql-database
99
ms.subservice: scale-out
1010
ms.topic: how-to
11-
ms.custom: sqldbrb=1
11+
ms.custom:
12+
- sqldbrb=1
13+
monikerRange: "=azuresql || =azuresql-db "
1214
---
1315
# Migrate existing databases to scale out
16+
1417
[!INCLUDE[appliesto-sqldb](../includes/appliesto-sqldb.md)]
1518

16-
Easily manage your existing scaled-out sharded databases using tools (such as the [Elastic Database client library](elastic-database-client-library.md)). First convert an existing set of databases to use the [shard map manager](elastic-scale-shard-map-management.md).
19+
Easily manage your existing scaled-out sharded databases using tools (such as the [Building scalable cloud databases](elastic-database-client-library.md)). First convert an existing set of databases to use the [shard map manager](elastic-scale-shard-map-management.md).
1720

1821
## Overview
1922

2023
To migrate an existing sharded database:
2124

2225
1. Prepare the [shard map manager database](elastic-scale-shard-map-management.md).
23-
2. Create the shard map.
24-
3. Prepare the individual shards.
25-
4. Add mappings to the shard map.
26+
1. Create the shard map.
27+
1. Prepare the individual shards.
28+
1. Add mappings to the shard map.
2629

2730
These techniques can be implemented using either the [.NET Framework client library](https://www.nuget.org/packages/Microsoft.Azure.SqlDatabase.ElasticScale.Client/), or the PowerShell scripts found at [Azure SQL Database - Elastic Database tools scripts](https://github.com/Azure/elastic-db-tools/tree/master/Samples/PowerShell). The examples here use the PowerShell scripts.
2831

@@ -42,7 +45,9 @@ New-ShardMapManager -UserName '<user_name>' -Password '<password>' -SqlServerNam
4245
# tenant-database mapping information.
4346
```
4447

45-
### To retrieve the shard map manager
48+
<a id="to-retrieve-the-shard-map-manager"></a>
49+
50+
### Retrieve the shard map manager
4651

4752
After creation, you can retrieve the shard map manager with this cmdlet. This step is needed every time you need to use the ShardMapManager object.
4853

@@ -56,21 +61,21 @@ $ShardMapManager = Get-ShardMapManager -UserName '<user_name>' -Password '<passw
5661
Select the type of shard map to create. The choice depends on the database architecture:
5762

5863
1. Single tenant per database (For terms, see the [glossary](elastic-scale-glossary.md).)
59-
2. Multiple tenants per database (two types):
64+
1. Multiple tenants per database (two types):
6065
1. List mapping
61-
2. Range mapping
66+
1. Range mapping
6267

6368
For a single-tenant model, create a **list mapping** shard map. The single-tenant model assigns one database per tenant. This is an effective model for SaaS developers as it simplifies management.
6469

65-
![List mapping][1]
70+
:::image type="content" source="media/elastic-convert-to-use-elastic-tools/listmapping.png" alt-text="Diagram of list mapping.":::
6671

6772
The multi-tenant model assigns several tenants to an individual database (and you can distribute groups of tenants across multiple databases). Use this model when you expect each tenant to have small data needs. In this model, assign a range of tenants to a database using **range mapping**.
6873

69-
![Range mapping][2]
74+
:::image type="content" source="media/elastic-convert-to-use-elastic-tools/rangemapping.png" alt-text="Diagram of range mapping.":::
7075

7176
Or you can implement a multi-tenant database model using a *list mapping* to assign multiple tenants to an individual database. For example, DB1 is used to store information about tenant ID 1 and 5, and DB2 stores data for tenant 7 and tenant 10.
7277

73-
![Multiple tenants on single DB][3]
78+
:::image type="content" source="media/elastic-convert-to-use-elastic-tools/multipleonsingledb.png" alt-text="Diagram of multiple tenants on single DB.":::
7479

7580
**Based on your choice, choose one of these options:**
7681

@@ -99,7 +104,7 @@ Setting up this pattern also requires creation of a list map as shown in step 2,
99104

100105
## Step 3: Prepare individual shards
101106

102-
Add each shard (database) to the shard map manager. This prepares the individual databases for storing mapping information. Execute this method on each shard.
107+
Add each shard (database) to the shard map manager. This prepares the individual databases for storing mapping information. Execute this method on each shard. The `$ShardMap` is the shard map created in [step 2](#step-2-create-the-shard-map).
103108

104109
```powershell
105110
Add-Shard -ShardMap $ShardMap -SqlServerName '<shard_server_name>' -SqlDatabaseName '<shard_database_name>'
@@ -112,29 +117,31 @@ The addition of mappings depends on the kind of shard map you created. If you cr
112117

113118
### Option 1: Map the data for a list mapping
114119

115-
Map the data by adding a list mapping for each tenant.
120+
Map the data by adding a list mapping for each tenant. Use the following sample PowerShell script to create the mappings and associate them with the new shards.
116121

117122
```powershell
118-
# Create the mappings and associate it with the new shards
123+
# Create the mapping and associate it with the new shards
119124
Add-ListMapping -KeyType $([int]) -ListPoint '<tenant_id>' -ListShardMap $ShardMap -SqlServerName '<shard_server_name>' -SqlDatabaseName '<shard_database_name>'
120125
```
121126

122127
### Option 2: Map the data for a range mapping
123128

124-
Add the range mappings for all the tenant ID range - database associations:
129+
Add the range mappings for all the tenant ID range - database associations. Use the following sample PowerShell script to create the mappings and associate them with the new shards.
125130

126131
```powershell
127-
# Create the mappings and associate it with the new shards
132+
# Create the mapping and associate it with the new shards
128133
Add-RangeMapping -KeyType $([int]) -RangeHigh '5' -RangeLow '1' -RangeShardMap $ShardMap -SqlServerName '<shard_server_name>' -SqlDatabaseName '<shard_database_name>'
129134
```
130135

131136
### Step 4 option 3: Map the data for multiple tenants on an individual database
132137

133-
For each tenant, run the Add-ListMapping (option 1).
138+
For each tenant, run the `Add-ListMapping` (option 1) cmdlet.
139+
140+
<a id="checking-the-mappings"></a>
134141

135-
## Checking the mappings
142+
## Check the mappings
136143

137-
Information about the existing shards and the mappings associated with them can be queried using following commands:
144+
Information about the existing shards and the mappings associated with them can be queried using following PowerShell sample script:
138145

139146
```powershell
140147
# List the shards and mappings
@@ -146,23 +153,9 @@ Get-Mappings -ShardMap $ShardMap
146153

147154
Once you have completed the setup, you can begin to use the Elastic Database client library. You can also use [data-dependent routing](elastic-scale-data-dependent-routing.md) and [multi-shard query](elastic-scale-multishard-querying.md).
148155

149-
## Next steps
150-
151-
Get the PowerShell scripts from [Azure Elastic Database tools scripts](https://github.com/Azure/elastic-db-tools/tree/master/Samples/PowerShell).
152-
153-
The Elastic database tools client library is available on GitHub: [Azure/elastic-db-tools](https://github.com/Azure/elastic-db-tools).
154-
155-
Use the split-merge tool to move data to or from a multi-tenant model to a single tenant model. See [Split merge tool](elastic-scale-configure-deploy-split-and-merge.md).
156-
157-
## Additional resources
158-
159-
For information on common data architecture patterns of multi-tenant software-as-a-service (SaaS) database applications, see [Design Patterns for Multi-tenant SaaS Applications with Azure SQL Database](saas-tenancy-app-design-patterns.md).
160-
161-
## Questions and feature requests
162-
163-
For questions, use the [Microsoft Q&A question page for SQL Database](/answers/topics/azure-sql-database.html) and for feature requests, add them to the [SQL Database feedback forum](https://feedback.azure.com/d365community/forum/04fe6ee0-3b25-ec11-b6e6-000d3a4f0da0).
156+
## Related content
164157

165-
<!--Image references-->
166-
[1]: ./media/elastic-convert-to-use-elastic-tools/listmapping.png
167-
[2]: ./media/elastic-convert-to-use-elastic-tools/rangemapping.png
168-
[3]: ./media/elastic-convert-to-use-elastic-tools/multipleonsingledb.png
158+
- [Azure Elastic Database tools scripts](https://github.com/Azure/elastic-db-tools/tree/master/Samples/PowerShell)
159+
- [Azure/elastic-db-tools](https://github.com/Azure/elastic-db-tools)
160+
- [Deploy a split-merge service to move data between sharded databases](elastic-scale-configure-deploy-split-and-merge.md)
161+
- [Design Patterns for Multi-tenant SaaS Applications with Azure SQL Database](saas-tenancy-app-design-patterns.md)

0 commit comments

Comments
 (0)