Its a tradeoff, security vs convenience, we had admin accounts and recently moved to PAM but because of the industry I am in, can't risk having 24/7 admin rights on an account. We don't use CyberArk and instead use Netwrix but same concept, elevate/request rights, have those rights for a period of time, and it times you out.
