A way for admins to edit users' external IDs

Can you use the sync_sso endpoint, essentially that allows you to push any payload you wish via the SSO chain?