What it does

Blurs sensitive values in screen recordings before anyone can play or download them. Frames are sampled from the recording, OCR finds the text, a PII classifier decides which of it belongs to the categories you picked, and those regions are blurred. Supervisors, evaluators and auditors review the masked version and never see the detected values. Because it works on pixels, it covers any application on the rep's screen, not just Dynamics 365.

Key facts

• Needs screen recording already switched on, plus an Azure AI services resource that provides Azure AI Vision (Read) for the OCR and Azure AI Language for PII detection. One multiservice resource can supply both, or you can point at two.
• Azure AI usage is billed to your Azure subscription, separately from Dynamics 365 licensing, and scales with the volume and length of recordings.
• Frames are processed in the region where the Azure resource lives, which isn't necessarily your Dynamics 365 region. Pick the resource region against your residency requirements, not by default.
• Authentication is Microsoft Entra ID: grant Cognitive Services User on the resource to the Dynamics 365 service principal, which is named in the form [<orgname>] <account name> <timestamp>. If the resource restricts network access, allow traffic from your environment's region.
• Switched on in Copilot Service admin center under Quality management > Enable screen and call recording > Manage, with Enable data masking set to On, the two endpoint URLs entered (trailing slash included) and the sensitive fields ticked.
• Selectable fields fall into three groups. PCI: card number, CVV, expiry date, PIN. PII: account number, person name, SSN, government ID, date of birth, tax ID, phone number, residential address, email address, passport number, driver licence number. Credentials: password.
• Settings apply to recordings processed after you save. Nothing already processed is masked retrospectively.
• If the endpoints are empty or unreachable, recordings carry on being captured, unmasked. There's no hard stop.
• Masking is irreversible. Nobody, including admins, can recover the original content of a blurred region.
• A masked recording only becomes playable once masking finishes, so it arrives later than an unmasked one of the same length.

When to use / skip

Use it where recordings will be reviewed by people who shouldn't see card data or identifiers, which in practice means anyone in PCI scope or running a large QA team. Pair it with the role split on screen recordings so the people who can download are a short list.

Skip it, or at least design around it, where recordings have to serve as evidence of what was on the screen. Irreversible blurring and a probabilistic detector are the wrong tool for a dispute or investigation workflow.

Configuration decisions

• Which fields to mask. Fewer fields keeps context for evaluators and cuts processing volume; more fields widens the net. Masking names is the call that most often annoys QA.
• One resource or two for Vision and Language, and which region each sits in.
• Who owns the Azure resource and its bill. It's usually not the team that owns the Dynamics subscription.
• Test approach. Decide who produces the seeded test recording and what dummy values they'll display.

Gotchas

• Selections are environment-wide. You can't mask differently per queue, workstream or rep. A team that needs names visible and a team that doesn't will be in the same compromise.
• Detection isn't guaranteed. Values shown as images, in stylised fonts, behind overlapping windows, at low resolution or only briefly can slip through. The reverse happens too: a case number that looks like an account number gets blurred.
• Audio isn't masked. This is visual only. Chat and asynchronous conversations use the separate data masking rules, and voice agents use the sensitive data setting in Copilot Studio. Don't present this as a complete answer to PCI.
• Fails open. Bad endpoint, expired role assignment or a locked-down network and recordings simply stop being masked, with nothing shouting about it. Spot-check recordings after any change to the Azure resource.
• Accuracy varies by language. It follows what Vision and Language support, so test in the languages your reps actually work in.

Consultant notes

• Treat masking as one layer in a compliance argument, not the argument. Microsoft says plainly that it reduces exposure without guaranteeing every value is caught, so the client's QSA or DPO needs to see it alongside role restrictions and retention, not instead of them.
• Run the test with a scripted rep showing dummy values for every ticked category, including awkward ones: card numbers split across fields, a password typed into a visible text box, a PIN in a payment tool. The gaps show up in the first ten minutes.
• Sort the Entra role assignment before UAT. The service principal name includes a timestamp, so people go hunting for it in the wrong place, and a missing role looks exactly like masking being switched off.
• Put a monthly check in the run book: play a recent recording and confirm it's blurred. Because failure is silent, somebody has to look.

---

Worth revisiting if per-queue field selection or audio masking is added.