We have split our organisation out to two different sub-estates, as we have different teams that manage servers and workstations. We would however like to be able to access each subestate using the same account with different permissions, so that a user is a admin in one estate, but read only or helpdesk in the other.