After the activation email expires, it seems our only option is to Deactivate, Reactivate, go to Directory Import, Comfirm Assignments... Then it take a while for all the previously assigned apps to populate again. I think I once had to remove the user from the AD group and then readd him and Directory Sync. Is there an easier way?
Another option is to trigger a password reset which will send out an email notification to reset their password. This will allow the user to perform a new user profile setup while resetting their password.