An edge case appears to exist in Discourse under the following conditions:
- an instance has SSO enabled
- a staged forum account exists on that instance which does not correspond to an SSO account
Under these conditions, this account may not be manually managed in the web interface (or ostensibly the API) because there is a global lock on accounts owing to SSO being enabled, but the account cannot be managed through SSO because it has no external SSO ID linked (and indeed, none exist).