Query: ad_authorization_policy_guest_invite_restricted

with distinct_tenant as (
  select
    distinct tenant_id,
    display_name,
    subscription_id,
    _ctx
  from
    azure_tenant
)
select
  id as resource,
  case
    when allow_invites_from in ('adminsAndGuestInviters', 'none') then 'ok'
    else 'alarm'
  end as status,
  case
    when allow_invites_from = 'none'
      then t.display_name || ' guest invitations disabled (no one).'
    when allow_invites_from = 'adminsAndGuestInviters'
      then t.display_name || ' guest invitations restricted to specific admin roles.'
    else
      t.display_name || ' guest invitations are too permissive: allow_invites_from=' || coalesce(allow_invites_from, '<null>') || '.'
  end as reason,
  t.tenant_id
  
from
  distinct_tenant as t,
  azuread_authorization_policy;