Seems like this may be working better now. I think checking this option:
“Overrides local email with external site email from SSO payload on every login, and prevent local changes.”
causes the newly changed email address to be copied into discourse the next time the person logs in.
Thanks for all the replies!