When using the Org Admin API to change the email address of an SSO enforced managed account an error will be returned.

    "errorKey": "forbidden.action",
    "errorDetail": {
        "allowed": false,
        "reason": {
            "key": "authPolicy.saml"

Suggestion :
Allow to change the email address of SSO enforced managed accounts via API.

Note that for accounts that are also provisioned, the email address change is expected to be blocked on Atlassian side.