Users authenticate to an internal website with ADFS (including MFA) and are then presented with a list of roles where they can either click through to the website assuming a role in that account for an hour, or click an option to access temporary credentials.
The AWS roles are deployed from our CI/CD pipeline to all of our AWS accounts, so we don't have to have user accounts anywhere and can still deploy features from our Pipeline without logging in.
We are also in the process of setting up automated account provisioning from our HR system, Workday. Based on the users team and job title, they'll be added into an Active Directory group which would then give them access to the resources required for their role.
Once complete, this will save the support team a lot of time!