Manage column masks

In Data Access, a column mask is a type of access control that masks data in specific columns for everyone except its beneficiaries. The beneficiaries see unmasked data in those columns only if they have access on the tables that contain the columns.

You can create a column mask to mask specific columns. If you create a column mask, users who already have access on the tables or views containing those columns see masked data in the columns, unless you add them as beneficiaries.

Prerequisites

• You own the tables or table views whose columns you want to mask.
• To create a column mask: You have a global role with the Data Access > Create Access Controls global permission, or you own any data object.
• To edit a column mask: You have a global role with the Data Access > Create Access Controls global permission, or you own the column mask or all of its data objects.

Steps

1. On the Data Access landing page, in the left pane, click ACCESS CONTROLS > Column masks.
2. Do one of the following:
   •  To create a column mask: Click Create column mask. On the Create column mask page, enter the information, and then click Create.
   • To edit a column mask: Click the name of the column mask, and then click Edit. Edit the information, and then click Save.

Result

• Ownership: You become the owner of the access control that you created. You can add more owners by clicking in the Owners field in the Details sidebar.
• Synchronization: Data Access automatically triggers a synchronization to push the access control to the underlying data source. Until the access control is created or updated in the data source, the Sync status field in the Details sidebar shows Not connected (for a new access control) or Out of sync (for an edited access control). After the synchronization finishes, the synchronization status changes to Synced.
• Unowned entities: If you selected a data object that you do not own, it is not added to the access control immediately. Instead, an access request is generated and assigned to the data object's owner. If the owner approves the access request, the data object is added to the access control. When this happens, the synchronization status of the access control changes to Out of sync briefly while Data Access pushes the changes to the data source. After the synchronization finishes, the synchronization status returns to Synced.

Guidance

Use this section to guide you when creating or editing a column mask. If the column mask was already created, on the column mask page, click Edit, and then complete the following sections.

General

In the General section, specify the basic properties of the column mask.

Field	Description
Name	A unique display name for the column mask, for example, Mask PII.
Description	A brief explanation of the column mask's purpose, for example, Masks PII for everyone except Finance.

Masking rule

In the Masking rule section, specify the columns that you want to mask.

1. In the Which columns are masked section, click Add.
2. In the Add access on dialog box, select one of the following options, and then click Continue.

   Option	Description
   Data objects	Masks the columns that you specify.
   Dynamic rule	Masks the columns that meet the conditions that you specify.

3. If you selected Data objects:
   1. In the Which tables do you want to mask dialog box, select the tables or views containing the columns that you want to mask, and then click Continue.
      
   2. In the Which columns do you want to mask dialog box, select the columns, and then click Add.
4. If you selected Dynamic rule:
   1. In the Where does the dynamic rule apply dialog box, select the data objects (from the same data source) within which you want the columns to be included in the rule, and then click Continue.
   2. In the Which conditions should apply dialog box, enter the required information, and then click Add.
5. To change the masking method for the columns:
   1. In the Where does the access apply section, in the Masking method column, double-click the current value.
      
   2. In the Edit masking method dialog box, select the new masking method, and then click Apply.

Beneficiaries

In the Beneficiaries section, specify the identities who can see unmasked data in the columns. You can also specify groups and other roles.

1. In the Who can see the data unmasked section, click Add.
2. In the Which type of beneficiary do you want to add dialog box, select one of the following options, and then click Continue.

   Option	Description
   Identities	A global exception that shows unmasked data in the columns to the identities that you specify, if they have access on the tables containing the columns.
   Groups	A global exception that shows unmasked data in the columns to the identities within the groups that you specify, if they have access on the tables containing the columns.
   Dynamic rule	A global exception that shows unmasked data in the columns to the identities that meet the conditions that you specify, if they have access on the tables containing the columns.
   Roles	A local exception that shows unmasked data in the columns to the beneficiaries of the roles that you specify, if they have access on the tables containing the columns, but only through the specified roles. That is, if the same beneficiaries have access on the tables through any other role, they see masked data.

3. If you selected Identities, Groups, or Roles, select one or more identities, groups, or roles, and then click Add.
4. If you selected Dynamic rule, in the Which conditions should apply dialog box, enter the required information, and then click Continue.
5. If the How should access be granted dialog box appears, select one of the following options, and then click Add. This step is applicable only to identities, groups, and dynamic rule.

   Option	Description
   Granted	Grants the beneficiaries immediate access to see the unmasked data until the expiration date, which is Unlimited by default.
   On request	Grants the beneficiaries an on-request access to see the unmasked data until the expiration date, which is Unlimited by default. Beneficiaries need to request access when they need it. Once requested, they receive access immediately, but only for the duration set in the Grant access for field, which is 14 days by default. They can request access multiple times until the expiration date, which is Unlimited by default. Each new request grants access for the specified duration (time does not accumulate). On the expiration date, the access is revoked and the identity can no longer request it.

6. To change the expiration date (which indicates when access is revoked) for the beneficiaries:
   1. In the Expires at column, double-click the current value.
      
   2. In the Edit expires at dialog box, select the new expiration date, and then click Apply.

Related topics

• Column masks
• How access controls sync
• Inheritance in access controls
• Deactivate or delete access controls