You will deploy an Azure SQL Database that will store personally identifiable information (PII). You must ensure that only privileged users can view the PII values while minimizing operational complexity. Which capability should you include?

Dynamic Data Masking (DDM) is the correct choice because it obscures sensitive data (like PII) in the result set of queries for non-privileged users, without altering the data in the database itself. This directly addresses the requirement to ensure only privileged users can view PII values while minimizing operational complexity, as it's a policy-based solution within the database. RBAC controls who can access the database or specific tables, but not how data within those tables is presented. Data Discovery & Classification helps identify sensitive data but doesn't mask it. TDE encrypts the entire database at rest and in memory, protecting against unauthorized access to the database files or backups, but it doesn't control visibility of data for users with legitimate database access.