To help close that gap, Microsoft has rolled out a new opt-in data masking capability for Dynamics 365 Contact Center. Tracked under Microsoft's AI at Work roadmap ID 576819 (and referenced in Microsoft 365 Message Center notifications as MC1466584), the feature has reached General Availability with a Launched status as of October 2026 for Worldwide (Standard Multi-Tenant) cloud instances on the web. While an earlier, now-archived Microsoft Learn 2026 release wave plan and September Message Center notices had targeted late September 2026 for general availability, the current roadmap status confirms the feature is live as of October 2026.
Here is a detailed breakdown of what this representative-driven redaction feature actually does, how it pairs with existing regular expression rules, and what Dynamics 365 administrators need to consider before flipping the switch.
From Regex to Human Judgment: What Changed
Until now, data masking in Dynamics 365 Contact Center and Dynamics 365 Customer Service relied strictly on automated, rule-based detection. Automated rules are indispensable, but they are only as smart as the regular expressions (regex) underneath them. If a customer types out digits using words, inserts unusual spacing, or shares sensitive context that does not fit a rigid alphanumeric pattern, a regex parser can let it slip right into your database.
The newly launched capability introduces manual, representative-driven message redaction to complement those automated rules. When enabled by an administrator, maker, or analyst, customer service representatives can select individual incoming messages from a customer and manually redact them. According to Microsoft's roadmap and release plan documentation, the explicit goal is to prevent inadvertently shared personally identifiable information (PII) from being stored in the organization's repository.
Rather than replacing automated detection, this gives contact centers a two-tier defense:
- Automated masking handles predictable, structured patterns immediately via regex.
- Manual redaction allows the human in the loop to catch unstructured or unexpected sensitive data on a per-message basis.
It is worth noting that this is strictly an opt-in feature configured by admins, makers, or marketers/analysts for end users. Individual service representatives cannot turn this capability on for themselves if an administrator has not enabled it for the environment.
How Existing Automated Data Masking Works
To understand where manual redaction fits in, it helps to look at the baseline automated system documented on Microsoft Learn for Dynamics 365 Contact Center (both embedded and standalone) and Dynamics 365 Customer Service.
In the existing rule-based architecture, data masking applies to conversation messages across live chat and asynchronous channels, replacing matched strings with masking characters—by default, the number sign (#)—both in the live conversation message and in the saved conversation transcript.
Microsoft provides three masking rules out of the box:
- Credit Card: Detects and masks credit card numbers shared in messages.
- Email: Detects and masks email addresses.
- SSN: Detects and masks Social Security numbers.
Administrators can modify or delete these built-in rules and create custom regex rules, up to a strict limit of 10 data masking rules total (including the out-of-the-box rules). That 10-rule ceiling is a major practical reason why manual redaction is so useful: when you only have ten regex slots to cover every conceivable type of sensitive data across your business, giving representatives a manual redaction button provides a vital safety net.
Furthermore, Microsoft Learn documents an interesting asymmetry in how existing rule-based masking behaves across channels:
| Direction of Masked Data | Live Chat Visibility | Asynchronous Channel Visibility |
|---|---|---|
| Representative-sent data (Mask private agent data from customer) | Masked for both the customer and the representative | Masked for both the customer and the representative |
| Customer-sent data (Mask private customer data from agent) | Masked for both the customer and the representative | Masked only in the representative's UI |
Configuring Automated Rules in Copilot Service Admin Center
While Microsoft's roadmap entry and archived release plan notes for roadmap ID 576819 do not detail the exact click-by-click toggle path for the new manual representative redaction feature, Microsoft Learn provides the exact administrative workflow for managing the automated data masking rules that work alongside it:
- Open the Copilot Service admin center site map.
- Navigate to Support experience and select Productivity.
- Locate Data masking and select Manage.
- Under Masking rules, select New Masking Rule.
- Provide a Name, an optional Description, and the Regular expression that defines the sensitive text pattern.
- Test your regex before deploying by entering sample text in the Enter test data field and verifying the
#-masked output in the Masked test data field. - Click Save, and ensure the rule status is set to Active using the ellipsis menu under Masking rules (inactive rules will not evaluate messages).
Critical Questions for Enterprise Admins and Compliance Teams
From an enterprise IT and data governance perspective, adding manual redaction is a welcome improvement, but administrators should not treat a roadmap blurb as a complete compliance strategy. Because Microsoft's public release description for roadmap ID 576819 is brief, organizations should test and verify several operational boundaries within their own tenants before relying on manual redaction for regulatory sign-off:
- Granularity of Redaction: The feature description states that representatives can "select individual messages from the customer and redact them." Admins should verify during rollout whether this redacts the entire selected message block or allows partial substring selection, and how that affects useful troubleshooting context in the same message.
- Downstream Storage and Logs: Microsoft states that redaction prevents the customer's PII from being stored in your repository. However, enterprise environments rarely have just one repository. If your Contact Center pipes real-time webhook events, Azure Application Insights telemetry, third-party CRM syncs, or AI training transcripts out of Dataverse as messages arrive, you must verify whether manual redaction happens before or after those downstream ingestion points fire.
- Channel Scope and Customer View: While existing automated rules explicitly document their behavior across live chat and asynchronous channels—including whether the customer sees the
#mask—the roadmap notes for manual redaction do not specify which exact omnichannel pathways support manual message redaction or how the redacted message renders on the customer's screen. - Reversibility and Auditing: What happens when a representative accidentally redacts a message containing a critical non-PII diagnostic code? Administrators should test whether manual redactions are permanent and irreversible, and whether audit logs track when a representative invokes a redaction.
Section Summary and Next Steps
The launch of customer service representative data masking in Dynamics 365 Contact Center (Roadmap ID 576819) brings human-in-the-loop common sense to omnichannel privacy. By pairing up to 10 automated regex masking rules with on-the-fly manual message redaction, support teams are much better equipped to keep stray customer PII out of organizational repositories.
Dynamics 365 administrators running Worldwide Multi-Tenant web environments should check the Copilot Service admin center for the new opt-in controls, verify how manual redaction interacts with their existing Dataverse transcript retention policies, and update representative training materials so support staff know exactly when—and how—to redact incoming messages.