I usually just call T-Support and ask if the PIN is properly provisioned, helps getting an email about the call stating the device doesn't have Enterprise Server on the account when I inform the user why it's not working.