Avoid bug where owner ends up unable to log in due to SSO enforcement,
by first requiring SAML to have been linked before allowing group
managed accounts to be enabled.

Long term we will offer to convert the user to a Group Managed one, so
would be able to remove this workaround.