Control: Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'

powerpipe control run azure_compliance.control.ad_m365_group_creation_disabled

powerpipe login
powerpipe control run azure_compliance.control.ad_m365_group_creation_disabled --share

with distinct_tenant as (
  select
    distinct tenant_id,
    display_name,
    subscription_id,
    _ctx
  from
    azure_tenant
)
select
  id as resource,
  case
    when not (value)::bool then 'ok'
    else 'alarm'
  end as status,
  case
    when not (value)::bool then t.display_name || ' Microsoft 365 group creation is disabled.'
    else t.display_name || ' Microsoft 365 group creation is enabled.'
  end as reason,
  t.tenant_id
  
from
  distinct_tenant as t,
  azuread_directory_setting
where
  name = 'EnableGroupCreation';