PAM is the combination of 2 legacy products, and two databases(uag and cspm). As a result, there is some information that is maintained in both databases. For example, there is user information and device information in both the uag and cspm databases. Some of this data is unique in each database, but some must be kept in sync. If it gets out of sync problems may be seen. Some problems may be the inability to edit or delete users.
When a user out of sync scenario is suspected it will be necessary to get the latest UserSync patch from Support, which repairs a number of previously identified scenarios. Install this patch just as any other. After doing so, go to the Session Log, to see what, if anything, has been fixed, before or after the entry for the UserSync Upgrade. Next try the same task as failed previously. If the problem still is not resolved Support will have to look deeper, as there could be a new scenario that is not handled by the patch. It is also possible that the issue could have another cause.
There is not currently a DeviceSync patch, as the linkages between the 2 databases is a bit more complicated for devices than it is for users. If it is necessary to resolve a device out of sync condition an ssh session will be required.
Eventually this issue should go away, as the intent is to unify the database.