While this article might be applicable in other environments, it is designed to address a deployment of the Microsoft Office 365 Dedicated.
On their mobile devices, users are unable to connect with their mailbox with Exchange ActiveSync (EAS).
The device is blocked by policy or because AllowNonProvisionableDevices is set to False in the ActiveSync mailbox policy.
Get-ActiveSyncDeviceStatistics -mailbox "<user>" | fl device*
Get-ActiveSyncMailboxPolicy <policy name> | fl