Based from this scenario: "A CRM admin (essentially having all access to CRM functions minus adding users and tweaking roles) wants to act as a Sales Rep without (a) asking for their credentials (b) dealing with their 2FA" You might want to add additional role to your employee without creating a new user: To assign one or…