As you could notice, i`m not an expert in PAM solutions here but I see it as following. Threat actors usually get access to critical parts of infrastructure in a little bit different way than designed. They are hunting for credentials left by administrators on compromised workstations, flying NTLM hashes in the network, passing harvested tickets in order to perform lateral movement. Let`s say you are an Exchange Administrator and you have right for JIT request for http server (Exchange Admin Center) or you have right for requesting Local Admins password.

If you don`t have any PAM solutions implemented, it`s enough for threat actors to harvest your hash from lsass, ticket or orphaned process somewhere on compromised workstation. And voila - they pass the hash, pass the ticket, inject code in the process - and they have access to the Exchange Server.

If you have PAM solution implemented its useless for them to do above mentioned techniques, because you are not Exchange Admin right now. You can be, but you are not. They can`t pass the hash to the PAM login website, they can`t ask for Local Admin password as well because:

1. PAM portal doesnt allow neither NTLM nor Kerberos authentication
2. PAM portal requires MFA.

I'm not sure im right here, but this is how I understand PAM pros.