Admins should be able to change the key of an Org Identity Source Record (with sufficient warnings). This would allow for a manual process to maintain a record link if the SOR ID changes for some reason (eppn changed by idp, record correction/merge upstream, etc).

An alternate method of searching for the record and manually linking it could work for some setups, but not non-queryable sources such as EnvSource.