Can be numerous reasons. We experience the same issue. If fact, the last one triggered compromised because the user tried to setup their exchange account manually. As a result the Active Sync failed. Here are a few I have personally experienced. User enrolls into Workspace (BYOD) and setups phone for Apple beta testing. User removed passcode, user jail broke phone, user has phone turned off longer that policy allows, user downloads a mail client not supported the your environment, Device fall off wireless for over x days, device turned off for x days, app removals, etc.. I normally check the exchange console and user profiles in WorkSpace. Also, incomplete enrollment will do that as well. If all fails I call the end user just to hear what their dog did to the device 🙂 Hope this helps.