Data source is registered on server, connecting to an SDE. Unfamiliar with the adding of workspace concept.
While users log in with named accounts via SAML and create their own content, anything that represents a single source of truth is created under a shared, local account with the publisher role, accessible to a few.
It is content created with this account that we intend to be read-only to the organization—standard things like buildings, roads, and parking lots—and historically we facilitate that through sharing map image layers to the organization, restricting the editable feature layer created with this account to Owner and no groups.
With the knowledge that we can publish non-editable feature layers to the organization and still edit them with the shared account, we might replace the functionally limited map image layers with feature layers configured with editing disabled. The immediate benefit are pop-ups that are enabled by default and capable of displaying more than just title and fields.
