I believe I have the URLs. Since avatars get populated when someone logs in, I was thinking that I could use the API (or console) to suck them down from SSO. The importers I’d looked at were uploading the avatars (which I don’t have), but now I see that I can pass a avatar_url to create_users, which should solve my problem.
Thanks.