That seems an issue with the fact that osquery, to avoid doing network calls, only queries for local users. There’s a similar issue/consequence to that: https://github.com/osquery/osquery/issues/7194

Interestingly if I do "net user" as the SYSTEM account, it says the command completed with one or more errors and doesn't list any AzureAD users is that expected?