canonical: https://jentic.com/apis/azure.com/azure-sql-database-datamasking-policies-and-rules

# Microsoft Azure Azure SQL Database Datamasking Policies and Rules

Jentic publishes the only available OpenAPI specification for Azure SQL Database Datamasking Policies and Rules, keeping it validated and agent-ready. The API manages dynamic data masking on Azure SQL databases under Microsoft.Sql, exposing the per-database dataMaskingPolicies resource and its child rules. Through 4 endpoints it supports reading and updating the masking policy and creating, listing, and deleting per-column rules so non-privileged users see masked values for sensitive fields.

## For AI agents

Configure dynamic data masking on Azure SQL databases by setting the dataMaskingPolicy and managing per-column rules so non-privileged users see masked values for sensitive fields.

## Scope

Does not handle row-level security, column encryption, or transparent data encryption - use for Microsoft.Sql dynamic data masking policy and rule operations only.

## Capabilities

- Read or update the dataMaskingPolicy on an Azure SQL database to switch masking on or off
- Create or update a per-column data masking rule with a masking function (default, email, number, text, custom)
- List every data masking rule attached to an Azure SQL database's masking policy
- Delete a data masking rule when a column is removed or no longer requires masking
- Apply masking rules across multiple columns to enforce least-privilege views of sensitive data
- Audit which columns have masking rules across a database for compliance evidence

## Use cases

### Mask PII Columns on a Customer Database

Apply dynamic data masking to PII columns (email, phone, ssn) on an Azure SQL database so non-privileged readers see masked values without changing the underlying data. PUT the dataMaskingPolicy to Enabled, then create per-column rules under /dataMaskingPolicies/{policyName}/rules/{ruleName} with the appropriate masking function. The rules apply at query time and are transparent to applications using privileged accounts.

Example prompt: Enable dataMaskingPolicy on database 'customers-db' under server 'prod-sql-eus' and create a rule masking the column 'email' on table 'dbo.customers' with the email masking function

### Audit Masking Coverage Across a Database

List every data masking rule on a database and produce an audit showing which sensitive columns are masked and which still expose plaintext values. The list endpoint returns rules with table, column, and masking function so an audit can flag gaps against a sensitive-column inventory. Pair with PUT to remediate gaps in the same automated sweep.

Example prompt: List every data masking rule on database 'customers-db' and emit a CSV of (tableName, columnName, maskingFunction) rows

### Decommission a Masking Rule on Schema Change

When a column is dropped from a table, the associated masking rule must be deleted to prevent stale rules from accumulating. DELETE on /dataMaskingPolicies/{policyName}/rules/{ruleName} removes the rule cleanly without touching other rules or the parent policy. This keeps the masking configuration aligned with the database schema across migrations.

Example prompt: Delete the data masking rule named 'email-mask' on database 'customers-db' under server 'prod-sql-eus'

### Agent-Driven Masking Policy Enforcement via Jentic

An AI agent uses Jentic to enforce a data masking policy across every Azure SQL database in a subscription: ensuring dataMaskingPolicy is Enabled and the canonical set of rules is in place. The agent searches Jentic for 'list data masking rules on an azure sql database', loads the schema, and chains it into PUT and DELETE operations to converge each database to the policy. Azure AD bearer tokens are sourced from your Jentic One instance per call.

Example prompt: Search Jentic for 'list data masking rules on an azure sql database', list rules on every database under server 'prod-sql-eus', and PUT or DELETE rules so each database matches the canonical masking policy

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/dataMaskingPolicies/{dataMaskingPolicyName} | Create or update the dataMaskingPolicy on a database |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/dataMaskingPolicies/{dataMaskingPolicyName} | Get the dataMaskingPolicy on a database |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/dataMaskingPolicies/{dataMaskingPolicyName}/rules/{dataMaskingRuleName} | Create or update a data masking rule |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/dataMaskingPolicies/{dataMaskingPolicyName}/rules | List data masking rules under a policy |

## Key resources

- **DataMaskingPolicies** — Read and update the per-database dataMaskingPolicy that toggles dynamic data masking on or off.
- **DataMaskingRules** — Create, list, update, and delete per-column data masking rules under a database's masking policy.

## Why Jentic

- **Setup:** Wiring the Azure SQL data masking API by hand means registering an Azure AD app, acquiring bearer tokens for https://management.azure.com/, and handling ARM throttling and error responses against the Microsoft.Sql provider yourself. Through Jentic you install once, import Azure SQL Database Datamasking Policies and Rules from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The database and rule ids travel in the URL path (/databases/{databaseName}/dataMaskingPolicies/{policyName}/rules/{ruleName}), so a rule can pin your agent to one database: it can read the masking policy and list its rules there and nothing else. You choose the operations it may call, so the create-or-update that changes a masking rule is not included unless you add it.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'mask a column on an Azure SQL database' or 'list data masking rules on an azure sql database', and Jentic returns the matching Microsoft.Sql dataMaskingPolicies operation with its input schema so the agent calls the right endpoint without browsing the ARM reference.

## Related APIs

- **Azure SQL Database Backup Long Term Retention Policy** — Manages long-term backup retention on Azure SQL databases that hold masked data.
- **Azure SQL Database Disaster Recovery Configuration** — Configures failover groups and DR replication on Azure SQL databases.
- **Azure SQL Database (checkNameAvailability)** — Validates Azure SQL server names during provisioning of the server that hosts the masked database.

## FAQ

### Why is there no official OpenAPI spec for Azure SQL Database Datamasking Policies and Rules?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure SQL Database Datamasking Policies and Rules via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Azure SQL Database Datamasking API use?

The API uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope on https://management.azure.com/. Through Jentic, the bearer token is fetched from your Jentic One instance and injected at call time so the agent never sees the raw client secret.

### How do I create a data masking rule for a specific column?

PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/dataMaskingPolicies/{dataMaskingPolicyName}/rules/{dataMaskingRuleName} with a body that includes schemaName, tableName, columnName, and maskingFunction (Default, Email, Number, Text, or CCN).

### What are the rate limits for the Azure SQL Database Datamasking API?

The spec does not declare per-API limits; calls are throttled by Azure Resource Manager's per-subscription budget for read and write operations on Microsoft.Sql. On HTTP 429, honour the Retry-After header before retrying.

### How do I list every masking rule on a database through Jentic?

Search Jentic for 'list data masking rules on an azure sql database', load the schema for GET /dataMaskingPolicies/{policyName}/rules, and execute it. Jentic injects the Azure AD bearer token automatically; the agent only supplies the server, database, and policy names.

### Is the Azure SQL Data Masking API free?

Yes - control plane calls to manage masking policies and rules are free. Dynamic data masking itself is included in Azure SQL Database service tiers at no additional charge.

### Can I limit what my agent is allowed to do with the Azure SQL Database Datamasking Policies and Rules API?

Yes. Because you self-host Jentic One, your own rules decide which operations and credentials the agent may use, and the database and rule ids travel in the URL path, so a rule can pin the agent to a single database where it reads the masking policy and lists its rules and nothing else. You choose the operations the agent may call, so the create-or-update that changes a masking rule and the delete that removes one are not available unless you add them. The Azure AD credential is exchanged for a short-lived bearer token at execution time and never enters the agent's prompt or logs.