Change email via SSO without user interaction

[sistason]

The email is used by Bitwarden for salting the Master Key. Therefore, it can only be changed by providing the Master Passphrase.

As #7468 mentions, during SSO-login (which normally updates the app-data from the SSO-claims) the user gets notified about a changed email and is prompted to change their mail in their profile.

For our setup, we disabled Vaultwarden mail configuration, to be able to auto-invite our SSO-users via the API, which they would otherwise have to accept but a users group in SSO is 1to1 with its users Orgs in Vaultwarden, so disabling mail was the only way we found to automate putting users in Vaultwarden-organisations.
This sadly means that we cannot send the email-change email prompt, so users will never be notified (and will never change their mail).

Do people integrate Vaultwarden differently in their SSO-setup here? What would be your tips to solve:

1. Mail disabled so that invite-confirms happens automatically
2. Mail-change prompt cannot be sent
3. to be fair: Mail is just cosmetic, as we cannot enable emails in Vaultwarden because of 1

---

Ideally I'd propose in the case of the SSO-mail differs from Vaultwarden-mail, we do not send a prompt. During SSO-login, afaik we have the Masterpassword-prompt next, so could use that during the login to change the email and the Master Key, e.g. chaining a call to the change-password endpoint in the profile.

What are your thoughts toward this automation?