Most common causes are:
APNS certificate expired
DEP token expired or not syncing properly
In some cases there are issues with the actual DEP profile itself and simply creating a new one and assigning it to those devices will resolve.
We also sometimes see cases where the devices simply didn't catch what they needed to fast enough (in laymans terms) or cached some incorrect info and an iTunes restore will set it on the right path.
Very rarely is it something outside of the above, but when it is, it needs to be looked in to by our dev teams (and in some even more rare scenarios - Apples teams)
------------------------------
Matt Shaver
System Architect
IBM
mshaver@us.ibm.com------------------------------