The administrator must be able to make the client catalog the default catalog. The administrator must also be able to make the client catalog the default catalog when the client's default catalog is set within the client's profile.

The administrator must have all the SELECT and EXECUTE grants, or roles that contain the grants, that the client user has on objects that you want to mask.

If the client session is set with query banding and one of the query bands is ProxyUser, the Dynamic Data Masking administrator must have the same CONNECT THROUGH grants as the client user.