Dynamic Data Masking : why the value =0 but should be >0

Question

I am testing Dynamic Data Masking using the article

https://www.mssqltips.com/sqlservertip/7887/dynamic-data-masking-in-sql-server-for-sensitive-data-protection/

The question is:

EXECUTE AS USER = 'TestManager2'
SELECT * FROM Employee
update Employee set ServicePeriodInYears = ServicePeriodInYears+1 where FirstName='Aram'
-- 0 but ServicePeriodInYears >0
update Employee set ServicePeriodInYears = 11 where FirstName='Sos'
-- 11
REVERT
SELECT * FROM Employee

The 1st update set the value always to 0 and did not change. But the 2nd works correctly = 11. Can anybody explain me why it is?

Answer 1

Just a hunch - did you grant unmask for those table columns to TestManager2? If not, despite the value being > 0, you may well fail to see it when queried. Your update is effectively trying to retrieve the current value before incrementing.