Column mask

In the Ultra Transcenders books

DBX-DEPDP-750

Each book explains Column mask in context, with comparison tables and the common traps.

Terms in this definition

• Serverless

  Compute tier for single Azure SQL databases that scales automatically, pauses when idle and charges by the second. It is offered in General Purpose and Hyperscale, not Business Critical, and reserved capacity does not apply.

• FUNCTION

  Registered models count as functions in Unity Catalog, so this securable type governs them too: access is given through GRANT ... ON FUNCTION, and REST calls pass FUNCTION as securable_type.

• Unity Catalog

  Azure Databricks' governance solution covering both data and AI in one place, with centralised permissions, auditing, data discovery and lineage.

• Agents (classic) API

  First-generation Foundry Agent Service API, based on threads, messages and runs. It is deprecated, replaced by conversations and responses, and retires on 31 March 2027.

• Set

  Secret permission in Key Vault for writing secrets; some older material refers to it as Create.

• Image edit mask

  A PNG matching the input image's dimensions in which fully transparent pixels (alpha 0) mark the sole region the model is allowed to alter.

• Event

  Table in Log Analytics where entries from Windows event logs are kept.

• Once flow

  A flow that executes a single time and repeats only if the pipeline is fully refreshed. It's a common choice for a first full load ahead of a change feed, and that refresh becomes dangerous once the original files no longer exist.

Related terms

• ABAC policy

  Governed tags drive this kind of Unity Catalog rule: when a table or column has tags that satisfy its WHEN and MATCH COLUMNS conditions, a row filter or column mask UDF is put on it automatically. Policies are written with CREATE POLICY and can sit on a metastore, catalog, schema or table.

• CREATE POLICY

  Attaches a named policy to a securable, stating who it affects and which tag conditions trigger it. The policy can be a column mask, a row filter, or an ABAC DENY or GRANT.

• MATCH COLUMNS

  Part of an ABAC column mask policy, this clause selects columns through a governed tag such as has_tag_value('pii', 'ssn'). Tags set on the table are ignored; only those on the column count.

• Rewind

  Winds a Lakeflow pipeline back to before a fault, covering operator state, source offsets and table contents, so the corrected run redoes only what was affected. It is in Beta, and any streaming table carrying a column mask or row filter is excluded.

• Table-level filters and masks

  A row filter or column mask attached to one particular table through a UDF. ABAC policies work differently, using governed tags and attaching as high as the metastore.