to get around it, give them a non-SAML role and try to get them to log in using the normal netsuite way (you might need to reissue the welcome email). Once they're in and set up (maybe with security questions?) you should be able to change their roles and updates to the employees should work