@tkates
I was thinking you had created a SAML v2 identity provider in FusionAuth which has a reconcile lambda.
Now, I understand that FusionAuth is configured as a SAML v2 IdP where FusionAuth is the system of record for the users. Thus, the application is setup as a SAML application using the SAML tab for the application which has the Populate Lambda.
Since that Lambda is for populating the SAML response, an option would be to use the Lambda HTTP Connect to update the user inside the populate lambda.