Query: ad_user_mfa_enabled

with distinct_tenant as (
  select
    distinct tenant_id,
    subscription_id,
    _ctx
  from
    azure_tenant
)
select
  r.user_principal_name as resource,
  case
    when not (r.is_mfa_registered = true) then 'alarm'
    else 'ok'
  end as status,
  case
    when not (r.is_mfa_registered = true) then r.user_display_name || ' (' || r.user_principal_name || ') does not have multifactor authentication enabled.'
    else r.user_display_name || ' (' || r.user_principal_name || ') has multifactor authentication enabled.'
  end as reason,
  t.tenant_id
  
from
  azuread_user_registration_details_report as r
  left join distinct_tenant as t on t.tenant_id = r.tenant_id
where
  r.user_principal_name is not null;