I’m not sure there is a way to automatically confirm through the UI/API. 
I think if there’s SSO then the email/identity confirmation is handled by them? In which case using the sso_sync would pull in the already confirmed data/email and use that as ‘trustworthy’.
A little bit of fact-checking later… 
The /admin/users/sync_sso is only for DiscourseConnect. I think you already knew that, but I’ll say it out loud for anyone reading this later.
But there’s also the auth_overrides_emails admin setting which may be useful for this.
Essentially, if your SAML provider is sending a verified email, and auth_overrides_emails is set, Discourse will start using the new email without any confirmation being emailed out. 