Short answer
HubSpot's KB: needs 2FA on the account. You can't log in as Super Admins or users with billing permissions, or users who haven't accepted their invite. Sessions last 30 minutes, and actions are logged.
1. In HubSpot
The relevant screen in my demo portal.

2. Worth knowing
Tell the user first, since actions show in their log.
3. Related
Login sessions and the audit log.