Control: 5.25 Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'

powerpipe control run azure_compliance.control.iam_subscription_tenant_transfer_restricted

powerpipe login
powerpipe control run azure_compliance.control.iam_subscription_tenant_transfer_restricted --share

select
  t.tenant_id as resource,
  case
    when (t.subscription_policy -> 'properties' -> 'blockSubscriptionsIntoTenant')::bool = true
      and (t.subscription_policy -> 'properties' -> 'blockSubscriptionsLeavingTenant')::bool = true then 'ok'
    else 'alarm'
  end as status,
  case
    when (t.subscription_policy -> 'properties' -> 'blockSubscriptionsIntoTenant')::bool = true
      and (t.subscription_policy -> 'properties' -> 'blockSubscriptionsLeavingTenant')::bool = true then t.display_name || ' subscription tenant transfer is restricted (Permit no one).'
    else t.display_name || ' subscription tenant transfer is not restricted. Block subscriptions into tenant: ' || coalesce((t.subscription_policy -> 'properties' -> 'blockSubscriptionsIntoTenant')::text, 'false') || ', Block subscriptions leaving tenant: ' || coalesce((t.subscription_policy -> 'properties' -> 'blockSubscriptionsLeavingTenant')::text, 'false') || '.'
  end as reason,
  t.tenant_id
  -- 
from
  azure_tenant as t;