Login-as and grant login access
Key Takeaway
Logging in as another user requires the "Modify All Data" permission. By default, admins can do this without any action from the user, but if the "Administrators Can Log in as Any User" setting is removed from the org, each user must grant login access first.
Log in as another user lets an admin troubleshoot a user's problem. The admin logs in to a Salesforce org or an Experience Cloud site as that user, uses that user's login, and can access the user's data. Grant login access is how a user gives an admin or Salesforce support temporary access to their account when the org requires it. Login Access Policies decide whether that grant is needed and who users may grant access to.
When a user must grant login access first
By default, a company's admins can access a user's account without any action from the user. The Administrators Can Log in as Any User setting in Login Access Policies lets admins log in as any user without first asking them to grant access.
To remove that setting from the org, you contact Salesforce. After it is removed, each user must grant login access before an admin can log in to their account.