Enable user management, workspace group creation, and workspace consent by default in config sample

Is your feature request related to a problem? Please describe.

New users deploying Azure TRE currently get a config sample where several features that provide the best out-of-the-box experience are disabled by default:

  user_management_enabled: false
  auto_workspace_group_creation: false
  auto_grant_workspace_consent: false

Because these are false in the config sample, users who follow the default path miss out on features such as:

• Assigning/de-assigning users to workspaces via the UI (user_management_enabled)
• Automatic creation of Entra ID security groups aligned to application roles (auto_workspace_group_creation)
• Removing the need to manually grant consent when creating new workspaces (auto_grant_workspace_consent)

This leads to extra manual configuration steps and a sub-optimal first experience.

Describe the solution you'd like

Update the config sample so these settings default to true, giving users the best out-of-the-box experience:

  user_management_enabled: true
  auto_workspace_group_creation: true
  auto_grant_workspace_consent: true

Describe alternatives you've considered

• Leaving the defaults as false and documenting the recommended values — this keeps the friction of manual enablement.
• Only enabling a subset of the three settings.

Additional context

These settings map to environment variables/config used throughout the codebase. Relevant references for anyone picking this up:

• Documentation describing these settings:
  docs/tre-admins/environment-variables.md

  • AUTO_WORKSPACE_GROUP_CREATION — grants Group.Create permission to the Application Admin identity (note: enabling this has Entra ID licensing implications, as group assignment is a premium feature).
  • AUTO_GRANT_WORKSPACE_CONSENT — grants Application.ReadWrite.All and DelegatedPermissionGrant.ReadWrite.All and removes the need for manual consent.
  • USER_MANAGEMENT_ENABLED — allows TRE Admins to assign/de-assign users to workspaces via the UI (requires Entra ID groups enabled on the workspace and workspace template version 2.2.0 or greater).

• Where the permissions are conditionally applied based on these flags:
  devops/scripts/create_aad_assets.sh

if [ "${AUTO_WORKSPACE_GROUP_CREATION:-}" == true ]; then
  APPLICATION_PERMISSIONS+=("Group.Create")
fi

if [ "${AUTO_GRANT_WORKSPACE_CONSENT:-}" == true ]; then
  APPLICATION_PERMISSIONS+=("Application.ReadWrite.All" "DelegatedPermissionGrant.ReadWrite.All")
fi

• Terraform variable defaults that may also need review:
  core/terraform/variables.tf

variable "auto_grant_workspace_consent" {
  type        = bool
  description = "A boolean indicating if admin consent should be auto granted to the workspace"
  default     = false
}

variable "user_management_enabled" {
  type        = bool
  description = "Is the Entra ID user management feature enabled (requires a workspace with Entra ID groups enabled, default to false)?"
  default     = false
}

• API config default:
  api_app/core/config.py

# User Management
USER_MANAGEMENT_ENABLED: bool = config("USER_MANAGEMENT_ENABLED", cast=bool, default=False)

Note: enabling these grants additional Entra ID permissions and may have licensing implications, so the documentation should be updated alongside the config sample change to make the trade-offs clear.