Useful to filter for only enabled accounts that are also licensed and disabled their UPN if MFA is disabled. Azure AD P1/P2 is required or it will return no data.

Users[?accountEnabled == && assignedLicenses.length(@) > && isMfaRegistered_r==].userPrincipalName