I'm playing with dynamic data masks in Azure SQL Db. This features only works for users who are not part of an administrative account, dbo included.

This means that I will have to connect to the db via a login with dbdatareader and dbdatawriter roles. Is this an issue with Umbraco, are there any special permissions that I need that are available under a different role?

Has anyone come across any other way of handling these concerns (masking sensitive data customer data) either dynamically or permaneantly?