SharePoint OTP for filename matching org name

type.inbound
// Microsoft sender
and sender.email.domain.root_domain == "microsoft.com"
// message ID contains the proper format for OTP messeges
and (
  (
    strings.istarts_with(headers.message_id, '<OneTimePasscode-')
    and strings.iends_with(headers.message_id, '@odspnotify>')
  )
  // deal with Google thinking the message ID is "broke"
  or (
    strings.icontains(headers.message_id, 'SMTPIN_ADDED_BROKEN')
    and any(headers.hops,
            any(.fields,
                .name == "X-Google-Original-Message-ID"
                and strings.istarts_with(.value, '<OneTimePasscode-')
                and strings.iends_with(.value, '@odspnotify>')
            )
    )
  )
)
// make sure the body has the phrase we need to get the document name
and strings.icontains(body.current_thread.text,
                      'For security purposes, you must enter the code below to verify your account to access'
)
// extract the filename and org name from the body and see if they are equal
and any(regex.iextract(body.current_thread.text,
                       'For security purposes, you must enter the code below to verify your account to access (?P<doc_name>.*)\. The code will only work for.*This email is generated through (?P<org_name>.*)''s use of Microsoft 365\.'
        ),
        .named_groups["doc_name"] =~ .named_groups["org_name"]
)