Is this good practice for making subdomains

If you are looking for automatic subdomains, based on a standard template (e.g. a subdomain for every user) you can use regular expression captures in your server_name directive. This approach will allow you to assign part of the server_name to a variable for use elsewhere in your configuration (e.g. to set a path).

It is generally good practice to put 'real' subdomains above the web root, to better separate the sites (and it has the advantage of preventing access via the main site), and to prevent ambiguity as to whether or not a directory maps to a subdomain or not. For example, consider the following path for the root of your 'dev' subdomain: /var/www/example.com/subdomains/dev/www. This would also let you maintain separate logs for your dev site, e.g. /var/www/example.com/subdomains/dev/logs).

The example below uses your pma subdomain as a template, and keeps the subdomain root under the main site.

server{
    #regex capture assigning the subdomain to $subdomain
    server_name ~^(?<subdomain>.+)\.example\.com$;

    #if the directory doesn't exist, redirect to the main site
    if (!-d /var/www/example.com/www/$subdomain) {
        rewrite . example.com redirect;
    }

    #if we have made it here, set the root to the above directory
    root /var/www/example.com/www/$subdomain;

    #the rest of your config
    index           index.php;
    access_log      /var/www/example.com/logs/access.log;
    error_log       /var/www/example.com/logs/errors.log;

    location ~ \.php$
    {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME /var/www/domain.com/$subdomain$fastcgi_script_name;
        include fastcgi_params;
    }

    location / {
        auth_basic            "Authentication Required";
        auth_basic_user_file  /var/www/example.com/$subdomain/authfile;
    }

    location ~ /\.ht{
        deny all;
    }

}

The above idea only really works if all the subdomains are going to follow the same template. In the configuration you have posted, the pma subdomain and the dev subdomain are substantially different (in that the dev subdomain has many rewrites that the pma one does not). Any subdomains that do not follow the 'template' you are using, will need their own server block and config. It is worth mentioning that in the case of two server blocks being applicable (e.g. one with a static server_name and one with a regex server_name), the static server_name will take precedence.