Isolate workspaces into individual subscriptions

[cricex]

Describe the solution you'd like
As an Information Security Officer
I want each workspace deployed into their own spoke subscription, each user's resources deployed into their own resource group within the workspace's subscription, and service resources deployed into a service resource group within the workspace's subscription
So that we may improve security isolation, billing isolation, and overcome subscription resource limitations

[marrobi]

Thanks, we would be limited to 800 resource groups per subscription. Is that an issue?

The separate resource groups for services and user resources can be handled in the respective templates. So no changes to the TRE APIs, or resources processor are required.

The subscription piece is doable, but work required.

[cricex]

Is 800 a TRE or ARM limitation? The documentation states that there is a limitation of 980 resource groups per subscription. (https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#subscription-limits)

Regardless, I believe 800 or 980 resource groups (and therefore 799 or 979 individual researchers) is sufficiently high limitation for an individual workspace.

[marrobi]

We will refine this feature into stages, separation of workspaces into subscriptions being the most requested ask.

[Danny-Cooke]

This feature has been requested by a third party so will be looking at how to deliver this or assist

[marrobi]

@SvenAelterman @Danny-Cooke is it worth us getting on a call to discuss requirements? Then a design can be posted here and discussed?