I am struggling to figure out the best method to set up security on an Azure SQL Managed instance. First, I tried to set up SQL logins, but since MUST_CHANGE isn't supported, I would then have access to everyone's password when I created the login, clearly an unacceptable solution. I then made myself the AD admin, and set up AD accounts. If I CREATE USER <user_name> FOR EXTERNAL USER in the master database, people can connect, but if I CREATE LOGIN <user_name> FOR EXTERNAL USER and then perform the CREATE USER commands in the other dbs linking to the login, people still get a login error.
Since I cannot define a DEFAULT_DATABASE on the CREATE LOGIN command, I am really confused about the security context. Am I really supposed to create users for everyone in the master database? That seems like a security hole. Am I missing something here?