AirWatch Console 8.4+
Applications assigned through device-based VPP do not get pushed to devices if they have a compromised status compliance policy that is currently pending. This particularly affects newly enrolled devices that do not have the AirWatch Agent installed, as the compromised status cannot be determined. The app does push successfully once the compromised status is determined.
Deploying the AirWatch Agent as a public application will allow it to install on devices, and ultimately allow the compromised status to be determined.
This has been resolved in AirWatch 9.1.