Navigate to the user's token list
Click the context menu icon of the inactive DeviceCert
Click "Activate" to activate the token