We would like to be able to update the user's email from outside (using the admin PUT identities endpoint) but doing so doesn't trigger a new email for validating the user's email.

I think you can create a recovery link https://www.ory.sh/docs/kratos/reference/api#operation/adminCreateSelfServiceRecoveryLink and when the user “activates” their account with it, the email should be verified. edit: sorry I composed this message and forgot to hit send 😓