Query: security_center_defender_for_api_enabled

select
  p.id as resource,
  case
    when p.name = 'Api' and p.pricing_tier = 'Standard' then 'ok'
    else 'alarm'
  end as status,
  case
    when p.name = 'Api' and p.pricing_tier = 'Standard'
      then 'Microsoft Defender for APIs is enabled with ' || p.pricing_tier || ' tier.'
    when p.name = 'Api'
      then 'Microsoft Defender for APIs is disabled, current tier: ' || p.pricing_tier || '.'
    else 'Microsoft Defender for APIs pricing not found.'
  end as reason
  
  , sub.display_name as subscription
from
  azure_security_center_subscription_pricing p
  right join azure_subscription sub on p.subscription_id = sub.subscription_id
where
  p.name = 'Api';