Query: azuread_device_join_restricted

select
  tenant_id || '/' || id as resource,
  case
    when azure_ad_join -> 'allowedToJoin' ->> '@odata.type' = '#microsoft.graph.enumeratedDeviceRegistrationMembership'
      or azure_ad_join -> 'allowedToJoin' ->> '@odata.type' = '#microsoft.graph.noDeviceRegistrationMembership' then 'ok'
    else 'alarm'
  end as status,
  case
    when azure_ad_join -> 'allowedToJoin' ->> '@odata.type' = '#microsoft.graph.enumeratedDeviceRegistrationMembership' then tenant_id || ' has device join restricted to selected users or groups.'
    when azure_ad_join -> 'allowedToJoin' ->> '@odata.type' = '#microsoft.graph.noDeviceRegistrationMembership' then tenant_id || ' has device join restricted.'
    else tenant_id || ' has device join allowed for all users.'
  end as reason
  , tenant_id as tenant_id
from
  azuread_device_registration_policy;