Question - Checked out PAM Account password

Hi everyone... As a hosting provider, we provide all the infrastructure our customers need to host their applications. These customers have several contractors who support the applications running on our infrastructure. That's why, at my company, check out processes is never performed by the contractors: after our customer provides us the proper authorization, we proceed granting check out for the contractors...
Given this scenario, we have two different types of account:

• the fixed ones: each customer have, by right, 3 domain accounts to be used by these contractors.
• the temp ones: there are special occasions when same customers need more than 3 accounts, so, we create 'temp' ones.

NOTE: All these contractors access our environment through a Windows TS Server.
So, I'm trying to setup Devolutions PAM solution to help us automate and audit all the external access from those two scenarios.
The first one is already mapped out and working like a charm: we've set up a provider and saved the accounts to a PAM Vault. Once in this case the check-in process do NOT terminate the account, we can access the TS by checking out the privilege account to ourselves, log in the TS using the privilege credentials, set some things up in the session according to the customer we're dealing with, and check in the privilege account when done. After that, we grant checkout to the contractor and the process is finished.
The second one is giving me headache. We reaaaaaly could use the benefits of JIT Accounts, because the account is created using RDM directly and is terminated automatically. The problem in this process is that I (as administrator) cannot view the password created for these types of users (when checked out) so I could log in the TS to setup it's session (only if I check out, but when I check in, the account is terminated and all I did in this session will be lost).
If I could only view the password, all my problems would be solved (at least as far as I got so far... lol):


If, by design, this possibility violates some major PAM principle and will not be considered at all... can you tell me if there's a way to accomplish our needs regarding the second scenario (without considering the possibility of creating these accounts manually in the DC, as we do nowadays)?

Sorry about the gigantic post... :)

Looking forward to hearing from you soon.

Regards,
Elaine Berenguer