In cases where the user information passed in SSO matches the GUID of one user, but the email address of another user, we will match based on the email address and update the GUID.

In certain situations, the GUID data is "cleaner", more unique and it makes more sense to match primarily based on the GUID as to be certain which user will be signed-in and any new data passed with SSO will update that user.