A retail company stores customer email addresses in an Azure SQL Database. Requirements: (1) support agents querying the table interactively should see only obfuscated emails like aXXX@XXXX.com, (2) the application service account must continue to read the full plaintext value to send order confirmations, and (3) the solution must require no changes to the application code or client drivers. Which feature should you implement?