SELECT *
FROM (
    -- Extract and normalize the minimum TLS version from various Azure services
    SELECT
        'azure_appservice_web_app_configurations' AS table,  -- Label the source table
        JSONExtractString(properties, 'minTlsVersion') AS properties__min_tls_version,  -- Extract min TLS version
        id  -- Preserve the ID for reference
    FROM azure_appservice_web_app_configurations

    UNION ALL  -- Use UNION ALL for performance (avoids deduplication)

    SELECT 'azure_cosmos_database_accounts', JSONExtractString(properties, 'minimalTlsVersion'), id
    FROM azure_cosmos_database_accounts

    UNION ALL

    SELECT 'azure_eventhub_namespaces', JSONExtractString(properties, 'minimumTlsVersion'), id
    FROM azure_eventhub_namespaces

    UNION ALL

    SELECT 'azure_hdinsight_clusters', JSONExtractString(properties, 'minSupportedTlsVersion'), id
    FROM azure_hdinsight_clusters

    UNION ALL

    SELECT 'azure_mariadb_servers', JSONExtractString(properties, 'minimalTlsVersion'), id
    FROM azure_mariadb_servers

    UNION ALL

    SELECT 'azure_mysql_servers', JSONExtractString(properties, 'minimalTlsVersion'), id
    FROM azure_mysql_servers

    UNION ALL

    SELECT 'azure_postgresql_servers', JSONExtractString(properties, 'minimalTlsVersion'), id
    FROM azure_postgresql_servers

    UNION ALL

    SELECT 'azure_redis_caches', JSONExtractString(properties, 'minimumTlsVersion'), id
    FROM azure_redis_caches

    UNION ALL

    SELECT 'azure_sql_managed_instances', JSONExtractString(properties, 'minimalTlsVersion'), id
    FROM azure_sql_managed_instances

    UNION ALL

    SELECT 'azure_sql_servers', JSONExtractString(properties, 'minimalTlsVersion'), id
    FROM azure_sql_servers

    UNION ALL

    SELECT 'azure_storage_accounts', JSONExtractString(properties, 'minimumTlsVersion'), id
    FROM azure_storage_accounts
) AS min_tls  -- Alias the subquery for readability

WHERE
    -- Convert the extracted TLS version string into a numeric value for comparison
    (
        toFloat32(
            replaceAll(
                regexpReplace(
                    replaceAll(properties__min_tls_version, '_', '.'),
                    '^tls', '', 'i'
                ),
               '-', '.'
            )
        ) < 1.2
        OR properties__min_tls_version = 'TLSEnforcementDisabled' -- Explicitly filter out disabled TLS enforcement
        OR NOT regexpLike(properties__min_tls_version, '.*1.*') -- Exclude values without '1'
    );