Using Entra ID authentication for internal workspace resources

There's already work in progress to embed the 'real' username into VMs, instead of a random 4-character name (#3770). I'd like to see that use of Entra ID username extended to other cases:

1. Whenever a Gitea instance is created, it could be pre-populated with the users registered in the workspace. Workspace admins can be given admin rights to Gitea, researchers can be given lower level access etc.
2. Likewise for MySQL or AzureSQL instances, they could support user-grained access to partition resources or control rights or prevent novice users from making serious mistakes.
3. There's also discussion about per-user storage somewhere (sorry, can't find the ticket right now). For my mind, it would be enough to have normal user-permissions on the existing shared storage, rather than having it all mapped into the one username. This feature has already been requested by one of our users.
4. Not sure if other resources could be made user-aware, such as Databricks, AzureML, OHDSI?

I'd be interested to hear if other people have any thoughts on this?

Start by reviewing the existing work in #3770 and the six comments on this issue. The proposal spans Gitea, MySQL or AzureSQL, shared storage, and other resources, so first establish which resource and permission model is in scope. Done should be defined as an agreed implementation target with its affected resources and validation plan.