ASP.Net Core 6 WebApp: How to throw IWA log in to user if not authorized?

If a user is not authorized to access a resource with his current account, how can I trigger a log in form in the browser so he could switch to his admin account? The web app is hosted in IIS. IIS settings are set to Windows authentication only.

E.g.: User Tom accesses a resource where everyone is allowed to see it, then he goes to authorized resource and instead of returning a response that he is not authorized - he should get a log in prompt to switch to TomAdmin account.

In my intranet web app I have this in Program.cs for authorization and authentication:

builder.Services.AddAuthentication(options => {
    options.DefaultAuthenticateScheme = IISDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = IISDefaults.AuthenticationScheme;
}).AddNegotiate();

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AmpUsers", policy => policy.RequireRole(Settings.Default.ValidUserRoles.Split(new char[] {','}, StringSplitOptions.RemoveEmptyEntries)));
});