Query: azuread_user_bitlocker_recovery_restricted

select
  tenant_id || '/' || id as resource,
  case
    when (default_user_role_permissions -> 'allowedToReadBitlockerKeysForOwnedDevice') is null then 'alarm'
    when not (default_user_role_permissions -> 'allowedToReadBitlockerKeysForOwnedDevice')::bool then 'ok'
    else 'alarm'
  end as status,
  case
    when (default_user_role_permissions -> 'allowedToReadBitlockerKeysForOwnedDevice') is null then tenant_id || ' has BitLocker key recovery setting not configured.'
    when not (default_user_role_permissions -> 'allowedToReadBitlockerKeysForOwnedDevice')::bool then tenant_id || ' has users restricted from recovering BitLocker keys.'
    else tenant_id || ' has users allowed to recover BitLocker keys.'
  end as reason
  , tenant_id as tenant_id
from
  azuread_authorization_policy;