You have an Azure SQL database named sqldb-ai-prod that stores customer support tickets for a...

Verified Answer : =

Support agents must see only the rows of their own TenantId → Create a row-level security (RLS) predicate that uses the user context.

Support agents must see only the domain name portion of CustomerEmail → Configure dynamic data masking on selected columns.

Comprehensive and Detailed Explanation with all Developing AI-Enabled Database Solutions documents : =

For the TenantId requirement, use Row-Level Security (RLS) . RLS is designed to restrict which rows a database principal can access. A security predicate can compare the row ' s TenantId with tenant information derived from the current user ' s session or security context, so support agents querying the same Tickets table see only rows belonging to their own tenant. This is the correct multitenant isolation mechanism because it is enforced by the database rather than relying on individual reporting tools or application-side filtering.

For CustomerEmail , use Dynamic Data Masking (DDM) . DDM controls how sensitive column values are displayed to users who do not have UNMASK permission. A partial masking rule can conceal the local/user- specific portion of an email address while exposing only the required portion, such as its domain, according to the masking configuration.

The remaining choices do not satisfy these specific requirements. Transparent Data Encryption (TDE) protects database files at rest but does not filter rows or selectively obscure query results. Always Encrypted protects sensitive values cryptographically and is appropriate when the database engine itself should not see plaintext, but it is not the right mechanism when support agents must deliberately see a controlled portion of an email address.

Final drag-and-drop selections:

Own TenantId rows → Create a row-level security (RLS) predicate that uses the user context

Only domain portion of CustomerEmail → Configure dynamic data masking on selected columns