Dynamic Data Masking uses the target database to retrieve metadata. For security rules that include column masking for

SELECT *

statements, Dynamic Data Masking first retrieves the list of columns. If the target database connection is not valid or if the DDM admin user credentials are not active, Dynamic Data Masking cannot retrieve the list of columns to apply the security rule. In such cases, Dynamic Data Masking generates and sends the following error to the client:

Required credentials are either invalid or missing. Contact your database administrator for assistance.

The error ensures that unmasked data does not appear on the database client.