Query: iam_subscription_tenant_transfer_restricted

select
  t.tenant_id as resource,
  case
    when (t.subscription_policy -> 'properties' -> 'blockSubscriptionsIntoTenant')::bool = true
      and (t.subscription_policy -> 'properties' -> 'blockSubscriptionsLeavingTenant')::bool = true then 'ok'
    else 'alarm'
  end as status,
  case
    when (t.subscription_policy -> 'properties' -> 'blockSubscriptionsIntoTenant')::bool = true
      and (t.subscription_policy -> 'properties' -> 'blockSubscriptionsLeavingTenant')::bool = true then t.display_name || ' subscription tenant transfer is restricted (Permit no one).'
    else t.display_name || ' subscription tenant transfer is not restricted. Block subscriptions into tenant: ' || coalesce((t.subscription_policy -> 'properties' -> 'blockSubscriptionsIntoTenant')::text, 'false') || ', Block subscriptions leaving tenant: ' || coalesce((t.subscription_policy -> 'properties' -> 'blockSubscriptionsLeavingTenant')::text, 'false') || '.'
  end as reason,
  t.tenant_id
  -- 
from
  azure_tenant as t;