Trigger: Detect & correct SQL servers TDE protector not encrypted with CMK

select
  concat(id, ' [', subscription_id, '/', resource_group, ']') as title,
  name,
  resource_group,
  subscription_id,
  _ctx ->> 'connection_name' as conn
from
  azure_sql_server,
  jsonb_array_elements(encryption_protector) encryption
where
  encryption ->> 'kind' = 'servicemanaged';