Protecting PII in Fabric

Ira_27 

I don't think Fabric currently providesdynamic masking policies that prevent privileged engineering roles from seeing sensitive values while still allowing authorized consumers to access them.

For highly sensitive PII, the common pattern is:

• Encrypt or tokenize PII before it lands in Fabric
• Expose only masked, tokenized, or anonymized values to Data Engineers (but restrict access to the decryption process to a very limited set of authorized users or applications)
  
  

RLS, CLS, and Dynamic Data Masking help control consumer access, but they do not prevent Fabric administrators or users with sufficient data access from potentially viewing the underlying data in Fabric.
If the requirement is that Data Engineers must never be able to see PII in plaintext, then the safest approach is to ensure plaintext PII never enters Fabric in the first place. Fabric should only receive encrypted or tokenized values, with decryption performed outside Fabric or at a tightly controlled application layer.
scenario, although Microsoft continues to invest in governance and security capabilities.

Appreciate if you can "Kudos" and/or "Accept as Solution" if this answered your query.