As an Admin, how to change user's Primary Email or add Secondary Emails when 'email editable' is off?

I’m pretty sure that’s because you’ve got SSO configured and the email address is controlled by your remote authentication server. Is that right?