Query: azuread_ga_not_local_admin_on_join

select
  tenant_id || '/' || id as resource,
  case
    when azure_ad_join -> 'localAdmins' is null then 'ok'
    when (azure_ad_join -> 'localAdmins' -> 'enableGlobalAdmins') is null then 'ok'
    when not ((azure_ad_join -> 'localAdmins' -> 'enableGlobalAdmins')::bool) then 'ok'
    else 'alarm'
  end as status,
  case
    when azure_ad_join -> 'localAdmins' is null then tenant_id || ' has Global Administrator role not added as local administrator during Entra join (setting not configured, default behavior).'
    when (azure_ad_join -> 'localAdmins' -> 'enableGlobalAdmins') is null then tenant_id || ' has Global Administrator role not added as local administrator during Entra join (enableGlobalAdmins not set).'
    when not ((azure_ad_join -> 'localAdmins' -> 'enableGlobalAdmins')::bool) then tenant_id || ' has Global Administrator role not added as local administrator during Entra join.'
    else tenant_id || ' has Global Administrator role added as local administrator during Entra join.'
  end as reason
  , tenant_id as tenant_id
from
  azuread_device_registration_policy;