With User Sync, the CRM feature that we are assigning off of (individually/group/role/role and subordinates) is what will dictate how the Pardot role gets mapped.

In this example, as we are working with Profiles, we will need 2 CRM Profiles to map to the 2 different Pardot Roles. We would in this case need to create a new CRM profile, likely called “Advanced Marketing”. This is pretty easy to do in the CRM, as we can clone the existing “Marketing” profile – see https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/users_profiles_cloning.htm
Then we assign the higher Pardot Role to the new higher CRM Profile.

It does irritate some CRM Admins to have 2 otherwise identical CRM Profiles with just a different name so we can attach different Pardot Roles for the Pardot User Sync.

For example, all of Marketing (SF Profile = Marketing) get the Pardot Role of “Marketing”, but one person is in charge of more in Pardot, so I want that one individual to get the Pardot Role of “Advanced Marketing”. If I map the SF Profile to Pardot Role of Marketing = Marketing, can I then manually change that one individual’s Pardot role = Advanced Marketing and the sync won’t set it back to what is mapped for their Profile?

This is a great point. Double- and triple-check that you have a profile mapped to the Pardot Admin role… or else!

Probably also best practice to leave a Pardot Only account with Systems Admin rights in case you lose SSO access from SF

With the Summer ’20 release customers with Pardot Business Units can enable User Sync. There also have been a few small changes to the steps for how to enable user sync in the recent release so it’s worth investigating again if you’ve not done it yet.