--測試 default 遮罩，在 varchar 型別
 ALTER TABLE Employee ALTER COLUMN Tel ADD MASKED WITH(FUNCTION='default()')
 GO
 --測試 default 遮罩，在 bit 型別 (bit會全為零)
 ALTER TABLE Employee ALTER COLUMN Gender ADD MASKED WITH(FUNCTION='default()')
 GO
 --測試 default 遮罩，在 money 型別
 ALTER TABLE Employee ALTER COLUMN Salary ADD MASKED WITH(FUNCTION='default()')
 GO
 --測試 default 遮罩，在 date 型別
 ALTER TABLE Employee ALTER COLUMN Hireday ADD MASKED WITH(FUNCTION='default()')
 GO
 --測試 email 遮罩，在 varchar 型別
 ALTER TABLE Employee ALTER COLUMN Email ADD MASKED WITH (FUNCTION = 'email()')

 --建立一般使用者 user1
CREATE USER user1 WITHOUT LOGIN
GRANT SELECT ON Employee TO user1
 
--以 sa (最高權限者) 瀏覽 (無遮罩)
SELECT * FROM Employee (NOLOCK);
 
--以 user1 瀏覽 (有遮罩)
EXEC AS USER='user1'
      SELECT * FROM Employee (NOLOCK);
 REVERT

 --測試自訂遮罩
 ALTER TABLE Employee ALTER COLUMN [Name] ADD MASKED WITH (FUNCTION = 'partial(1,"X",1)')  --Name 保留第一個和最後一個字，其他用 X 取代
 ALTER TABLE Employee ALTER COLUMN CreditCard ADD MASKED WITH (FUNCTION = 'partial(0,"xxxx-xxxx-xxxx-",4)') --信用卡，只顯示最後四碼
 ALTER TABLE Employee ALTER COLUMN ID ADD MASKED WITH (FUNCTION = 'partial(2,"________",0)')  --ID 保留前兩個字，其他用 8 個底線符號取代
  
 --測試亂數遮罩
 ALTER TABLE Employee ALTER COLUMN Salary ADD MASKED WITH(FUNCTION = 'random(10000,100000)')  --Salary 顯示介於 10000 到 100000 的亂數

SELECT m.name, t.name, c.user_type_id, m.is_masked, m.masking_function
 FROM sys.masked_columns (NOLOCK) m
 JOIN sys.tables (NOLOCK) t ON m.[object_id]=t.[object_id]
 JOIN sys.columns (NOLOCK) c ON m.[object_id]=c.[object_id] AND m.name=c.name
 WHERE m.is_masked=1;