Microsoft helped me solve the problem. The name of the active sync virtual directory needs to be exactly "Microsoft-Server-ActiveSync" with Basic authentication. When I recreated the virtual directories to try to solve the original permission problem, I re-created the directory with the wrong name. The /Exchange directory should have both Intregrated and Basic authentication.
