Can Username Change be limited to number of times?

Discourse can be configured to override the username with one provided in the SSO payload.

Why not make your IdM authoritative in this case and control renaming from there?