Reveal a masked Dataverse column with Dataverse.Unmask

Masking rules on secured Dataverse columns show ****-1234 instead of a full IBAN or national ID. That is what you want in a list, but a support agent sometimes needs the real value for one customer, for one call. Canvas apps had no clean way to ask for it. The new Dataverse.Unmask function does exactly that: it reads the unmasked value of one column of one record, on demand, and Dataverse still decides whether the user may see it.

As of November 2026, the function is in preview: its rollout started in October 2026 and Microsoft presented it in its October/November 2026 feature update. Treat it as such before you build a production process on it.

Before you start

The function does not grant anything. According to its reference page, the user needs:

• access to the table and to the record;
• Read permission on the column through a column security profile;
• the appropriate Read unmasked permission in that profile.

The column itself must have column-level security enabled, and masking rules require a managed environment. A secured column does not necessarily have a masking rule: check both. Ask your admin for the narrowest Read unmasked option that fits the scenario rather than All records.

Test with a non-administrator account. Column-level security does not hide data from system administrators, so testing as an admin proves nothing.

The pattern: masked by default, revealed on request

The syntax is short:

Dataverse.Unmask( Record, Column )

The result has the type of the column: a text column returns text, not a record. Here is a reveal-and-hide pattern for an illustrative Contacts table with a secured text column 'Bank account', shown in a gallery named galContacts.

A label outside the gallery displays the value. Its Text property shows the masked value until the user asks for more:

If(
    locShowBankAccount,
    IfError(
        Dataverse.Unmask( galContacts.Selected, 'Bank account' ),
        "Value not available."
    ),
    galContacts.Selected.'Bank account'
)

Two buttons switch the state, and every change of context switches it back off:

Control and property	Formula
Show button, OnSelect	UpdateContext({ locShowBankAccount: true })
Hide button, OnSelect	UpdateContext({ locShowBankAccount: false })
Show button, DisplayMode	If(IsBlank(galContacts.Selected), DisplayMode.Disabled, DisplayMode.Edit)
Gallery, OnSelect	UpdateContext({ locShowBankAccount: false })
Screen, OnVisible and OnHidden	UpdateContext({ locShowBankAccount: false })

Resetting the state when the selection changes matters: without it, the agent selects another contact and the label requests the unmasked value of the new record without anyone asking for it. The how-to page also recommends making the gallery's child controls select their parent (Select(Parent)) and showing a loading indicator, since the read is asynchronous.

The rules that will trip you up

• The record must keep its Dataverse identity. A gallery selection, a LookUp result, or a record stored in a variable or collection works. A record you build yourself with the same fields does not.
• One source per variable. A variable that has held records from two different tables is rejected, even if both tables have a column with the same name.
• Column identifiers, not strings. Use 'Bank account' (single quotes, display name) or the logical name. "Bank account" in double quotes is a text literal and fails.
• Supported column types are scalar. Lookup, file, image, record, table and untyped columns cannot be unmasked.
• Blank is not an error. If the request succeeds but returns no value, the result is blank; IfError only catches real errors. A blank label does not prove a permission problem, and a permission problem does not always produce an error.

Handle the value as sensitive

The function may reuse a cached result instead of calling Dataverse again, so a permission removed a minute ago is not necessarily rechecked. Hiding a label is a user-interface choice, not a security boundary, and it does not clear the cache. And of course, never store the revealed value with SaveData, write it to a log, or copy it to a table with weaker protection.

Key takeaways

Dataverse.Unmask gives canvas apps a proper "show me this one value" feature on masked columns, with Dataverse column security still in charge. Configure the Read unmasked permission narrowly, reset the reveal state on every change of context, test with a non-admin account, and remember that it is a preview as of November 2026.

Researched and drafted with AI assistance, then reviewed, edited and published by a human.

Sources

1. Dataverse.Unmask functionlearn.microsoft.com
2. Reveal a masked Dataverse column valuelearn.microsoft.com
3. What's new in Power Platform: October/November 2026 feature updatemicrosoft.com