Table of Contents

Search

  1. Preface
  2. Introduction to Dynamic Data Masking Administration
  3. Authentication
  4. Security
  5. Connection Management
  6. JDBC Client Configuration
  7. ODBC Client Configuration
  8. Access Control
  9. Logs
  10. High Availability
  11. Server Control
  12. Performance Tuning
  13. Troubleshooting
  14. Appendix A: Database Keywords

Administrator Guide

Administrator Guide

Active Directory Authentication-Based User as Administrator

Active Directory Authentication-Based User as Administrator

Log in as the Active Directory administrator in the target database and run the following commands:
  • CREATE USER <Azure_Active_Directory_DDM_Admin> FROM EXTERNAL PROVIDER;
  • ALTER ROLE db_datareader ADD MEMBER <Azure_Active_Directory_DDM_Admin>;
  • GRANT VIEW DATABASE STATE TO <Azure_Active_Directory_DDM_Admin>

Additional Privileges for SELECT * Statements

If your Dynamic Data Masking security rules need to support column masking on SELECT * statements, you must also run the following command:
GRANT CONTROL TO <Azure_Active_Directory_DDM_Admin>
Alternatively, you can run the following commands:
  • GRANT ALTER ANY USER TO <Azure_Active_Directory_DDM_Admin>
  • GRANT IMPERSONATE ON USER :: <Azure_Active_Directory_DDM_Client> TO <Azure_Active_Directory_DDM_Admin>
If you have both Microsoft SQL Server authentication-based users and Active Directory authentication-based users, then use the Active Directory user as the Dynamic Data Masking administrator.

0 COMMENTS

We’d like to hear from you!