Azure Synapse Column-Level Security — Restrict Column Access with GRANT

Quick Answer

Column-level security does exactly what its name suggests: it lets you grant SELECT permission on specific columns of a table to specific users or roles, so a query from someone without that grant simply cannot retrieve data from the restricted column at all, and fails outright rather than returning something. Setting the GRANT to apply only to the salary columns and only to the HRManager role means anyone outside that role loses access to just those columns while retaining normal access to the rest of the table. Row-level security restricts which entire rows a user can see, filtering the table horizontally rather than restricting specific columns, so it would not help when the goal is hiding one type of information across every row. Dynamic data masking looks similar since it also affects what a user sees in a column, but it works by obscuring or replacing the values shown, not by blocking access outright; the underlying access still happens, just with masked output rather than a true security boundary. Azure Purview is a data governance and cataloging tool, useful for discovering and classifying sensitive data, but it does not enforce access restrictions. When you see a requirement to restrict specific columns to a specific role, column-level security via GRANT is the mechanism built for exactly that.