Ensure that user is signed in to Discourse

Hi
I find myself in the same situation.
I will be migrating users to discourse. Until they login via the SSO, there will be no record in the single_sigon_records.

If any one of my users changes his email in the main app, before attempting an SSO into discourse, then the next time he comes to discourse will be with a new email address, which will fail.

I do not want to use a pre-staging strategy as some of those users may never even login to discourse, hence want to avoid creating records for no reason.

But if i have to go down this route, could I insert data into the ‘single_sigon_records’ table manually, or would it have to be via the sso_sync endpoint?
I notice the table has a ‘last_payload’ field, which could be problematic in this case?

regards
shahid