This approach addresses two of the known problems with shared accounts:
- "The more people have a password, the more easily it leaks."
- "Once a person leaves, the password needs to change for everybody."
It doesn't affect the third. Depending on the application, this may be more or less important:
- "When the user makes a change, there's no way to tell which person did it."
If you're not deeply concerned about attribution, but feel it will be easier to force key changes and control key distribution under the new scheme, then yes, this is reasonable.
If you're hoping to address attribution as well, then this is not making a significant change.
If you can put your 2FA behind an application control that /is/ per-user, then you can come close to achieving all of them. People use their individual credentials to get the current 2FA code from a single central location, then use that code to log into the application, and by correlating the two sessions you can determine who was logged into the application for a given session. The code is always changing, and the 2FA device is centralized and not shared, so departing users don't have ongoing access. And with proper access control over access to the 2FA device, the leakage problem is lessened.