I don't know a ton about managed Apple IDs, but I can say that failed activations likely aren't something that you would be able to resolve through anything on the device or management side; usually you'll have to take those problems straight to Apple Support to have them suss out what's busted on the back end of things.
Alternatively, since it is a cloud services change, it may need some time to disseminate your change in ASM throughout iCloud. I've seen Azure take literal hours to make changes like this, but I'm not sure if ASM suffers from the same iffy timetables.
Got the issue resolved. Had to adjust settings in Roles in ASM and then have users sign out and sign back into their devices. 👍