Navigate to the user's token list

Click the context menu icon of the inactive DeviceCert

Click "Activate" to activate the token