Do I understand that you are confused that when email_editable is turned off you are unable to edit emails?
It’s hard to imagine just why you want to edit emails and have edit-emails turned off, or why your SSO isn’t managing the email address. I’m not sure that I can help.
Thanks for help, now I understand I have to make the SSO managing the email address, and turn off email editable, to prevent the situation that users can transfer accounts simply by editing email .
Currently, some users want to add Secondary Emails, but someone used this feature to transfer accounts .