Hmmm.
I think I was maybe working on the assumption that the move to the new IDP would have mapped them across based on an external id of some sort.
I think it is possible to activate/confirm the email through the rails console by adding in the token info too. Something like:
old_domain = "<insert_here_the_old_domain>"
new_domain = "<insert_here_the_new_domain>"
users = UserEmail.where("email like '%" + old_domain + "'")
users.each do |user_email|
user = User.find_by_id(user_email.user_id)
user.email = user.email.gsub(old_domain, new_domain)
user.email_tokens.create(email: user.email)
user.activate
user.save!
puts "."
end