The AKS Review workbook is incorrectly identifying public API endpoint compliance. The query logic is incorrect.
Current (incorrect) logic:
compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges))
Correct logic:
compliant = ( (isnull(properties.apiServerAccessProfile.enablePrivateCluster)==true) or ( isnull(properties.apiServerAccessProfile.enablePrivateCluster)==false and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges) ) )