Hi @Isla just to follow up, I discussed this with the team - blocking admins from changing email addresses was an intentional fix put in place 10 years ago and protects admins from accidentally breaking SSO (Single Sign On). The workaround to quickly enable/disable the setting so you can change an email address gives Admins a way to accomplish the occasional requested edit, and our product managers will look into improving the UI to direct Admins to that setting so that it’s easier for them to understand what needs to be done.
I’m sorry for the inconvenience and initial misunderstanding with this setting.
I am curious though, why do you not want your users to be able to edit their own email addresses? Perhaps there may be another way to address the concern you have.