How to Securely Store Secrets in Dynamics 365 Business Ce...

Why Field Masking Is a Good Idea for Sensitive Data

When building solutions in Business Central, securing sensitive data by design should be a standard practice.

Business Central offers two ways to mask sensitive data on the UI level:

ExtendedDatatype = Masked property
MaskType = Concealed property

Both types cannot be used at the same time.

ExtendedDataType

This property allows to display field value as dots instead of showing the actual content.

Dynamics 365 Business Central: ExtendedDataType

1
ExtendedDatatype = EMail;

Propety MaskType

A new field property was introduced in Dynamics 365 Business Central 2025 Release Wave 2.

Dynamics 365 Business Central: MaskType

1
MaskType = Concealed;

Property works similar to ExtendedDataType = Masked but it has couple differences:

Property is limited only to few types: Code, Text, Decimal, Integer, and BigInteger.
The UI field can be switched to “Show Value” mode by the user.
The field is not masked at the table level — masking applies only at the page (UI) level.

1
table 50401 "Masked Secret"
2
{
3
    Caption = 'Masked Secret';
4

5
    fields
6
    {
7
        field(1; "Code"; Code[20])
8
        {
9
            Caption = 'Code';
10
        }
11
        field(2; "Table ExtendedDatatype Secret"; Text[250])
12
        {
13
            Caption = 'Table ExtendedDatatype Secret';
14
            ExtendedDatatype = Masked;
15
        }
16
        field(3; "Page ExtendedDatatype Secret"; Text[250])
17
        {
18
            Caption = 'Page ExtendedDatatype Secret';
19
        }
20
        field(4; "Table MaskType Secret"; Text[250])
21
        {
22
            Caption = 'Table MaskType Secret';
23
            MaskType = Concealed;
24
        }
25
        field(5; "Page MaskType Secret"; Text[250])
26
        {
27
            Caption = 'Page MaskType Secret';
28
        }
29
    }
30
    keys
31
    {
32
        key(PK; Code)
33
        {
34
            Clustered = true;
35
        }
36
    }
37
}
38

39
page 50403 "Masked Secret"
40
{
41
    ApplicationArea = All;
42
    Caption = 'Masked Secrets';
43
    UsageCategory = Administration;
44
    SourceTable = "Masked Secret";
45

46
    layout
47
    {
48
        area(Content)
49
        {
50
            group("ExtendedDatatype Secrets")
51
            {
52
                field("Table ExtendedDatatype Secret"; Rec."Table ExtendedDatatype Secret")
53
                {
54
                    ToolTip = 'Specifies the value of the Table ExtendedDatatype Secret field.';
55
                }
56
                field("Page ExtendedDatatype Secret"; Rec."Page ExtendedDatatype Secret")
57
                {
58
                    ExtendedDatatype = Masked;
59
                    ToolTip = 'Specifies the value of the Page ExtendedDatatype Secret field.';
60
                }
61
            }
62
            group("MaskType Secrets")
63
            {
64
                field("Table MaskType Secret"; Rec."Table MaskType Secret")
65
                {
66
                    ToolTip = 'Specifies the value of the Table MaskType Secret field.';
67
                }
68
                field("Page MaskType Secret"; Rec."Page MaskType Secret")
69
                {
70
                    MaskType = Concealed;
71
                    ToolTip = 'Specifies the value of the Page MaskType Secret field.';
72
                }
73
            }
74
        }
75
    }
76

77
    trigger OnOpenPage()
78
    begin
79
        if not Rec.Get() then begin
80
            Rec.Init();
81
            Rec.Insert();
82
        end;
83
    end;
84

85
}

Is the Data Really Secured?

It is important to understand that field masking protects data only at the UI level. It does not encrypt the data and does not prevent access through other mechanisms.

Configuration packages

A user can easily expose sensitive data by exporting it to Excel using the Configuration Packages module. Dynamics 365 Business Central: Masked Fields

AL Debugging

A developer debugging the application can also see the full field value. Dynamics 365 Business Central: Masked Fields

SQL

And finally — good old SQL Server. If someone has direct database access (in On-Prem scenarios), the data is stored in plain form unless additional protection mechanisms are used. Dynamics 365 Business Central: Masked Fields

Conclusion

Field masking is a recommended design pattern for hiding sensitive user data in the UI. However, it should never be considered a security mechanism for protecting secrets such as:

API tokens
authentication keys
passwords
and other secrets

Field masking improves user experience and reduces exposure — but it does not provide real data security.

How to Securely Store Secrets in Dynamics 365 Business Central: Does Field Masking Protect Secrets?

Table of Contents