Entra Entitlement Management - Change guest user lifecycle from Governed to Ungoverned - Is it possible?

Background

In our Azure Entra tenant, we initially started provisioning external guest users a few years ago with Entitlement Management using Access Packages (which would then assign those guest users to specific Resource roles). When a guest user is created in this manner, Entra marks their User lifecycle as "Governed" under that specific Access Package. Based on our settings under "Lifecycle of external users", we have enabled the options for "Remove external user" and "Block external user from signing in to directory". Which means that when a guest user loses their last assignment to any access package, they would be immediately blocked from signing into our Entra ID.

Now, after a few years, we have decided to NOT use Access packages, and instead use SCIM for external guest user provisioning. We basically have created our own custom SCIM endpoint in Azure, and our customers/partners then provision their users into our Entra by calling our SCIM endpoint. These users are still created as External guest user in our Entra but now using SCIM protocol. This process works well for newly created external guest users.

However, where we run into issues is with old/existing external guest users who were previously already created in our Entra via the Access Package route. When the same guest user is now provisioned using SCIM, we are finding that if we remove those guest user assignment from all Access Packages, then even though they are now provisioned using SCIM, the guest user gets blocked immediately from our Entra. I guess this is happening due to the above "Lifecycle of external user" setting.

Questions

1. I have looked through Entra Entitlement Management documentation, and it seems that it is NOT possible to convert a "Governed" user to "Ungoverned" within an Access Package assignment. You can only convert from "Ungoverned" to "Governed". Is this correct?
2. What is the correct way of "migrating" these existing guest users who were previously provisioned using Access Packages, into our new SCIM access model, such that they do not lose their access to our Entra and do not get blocked when we remove all their assignments from existing access packages? I can think of a couple of options stated below, but I am not sure what is the best way to do this
   1. Remove all access package assignments from the external guest user in Entra, let them get blocked. Then manually Reactivate them in Entra, and provision their access through SCIM. Will this ensure that these guest users do not get deleted/removed after the 30 day setting above?
   2. Remove/Delete the already created guest user completely from Entra. Then reprovision them all over again using SCIM. This has the downside that the user will temporarily lose access to our Azure hosted applications, until they are reprovisioned using SCIM.
   3. Amend the above "Lifecycle of external user" settings to NOT block and NOT delete guest users when they lose all access package assignments. However we do not prefer this option as there are certain external entities who will still use Access Packages to provision their users into our Entra as guests (they do not fall under the scope of SCIM), so we would like these lifecycle settings to remain as-is so that such Access package provisioned guest users continue to get blocked/deleted as per lifecycle settings

I would be grateful for some thoughts on the above.

Thanks

Murali