When I have users log in with their SSO credentials and they have a new email address, the email would automatically update, but they got a new generic account auto-provisioned. I have to manually find their old user ID to update with their new email, then remove the duplicate auto-provisioned account. That's fine for a couple here and there, but for a bulk change like you mentioned I would suggest opening a support ticket for help in planning that migration.