Strategies for managing security role assignments / compute

[BradAF]

How is everyone handling RBAC role assignments such as AzureML Data Scientist role to the workspaces after deployment?

Ideally what we'd like to have is a map of user's UPN and desired compute SKU, and this is spun up and torn down as users are added or removed. However, it seems as though this must be done manually and resources do not get torn down because we are using bicep deployment at the subscription scope level. Terraform is an option for the teardown part, but I think we'd prefer to just create the resource group as part of the script and deploy at the RG scope with --mode complete but curious what others are doing.