...
Microsoft Surface Hubs are not compatible with Conditional Access Policies and are unable to authenticate unless they are manually excluded from every policy (https://docs.microsoft.com/en-us/surface-hub/create-and-test-a-device-account-surface-hub). The exclusion group is
Exclusion Group: 99a683be-a6a4-45d0-9bff-555a0f6d319c / Surface.Hub.Conditional.Access.Bypass.Group@austin.utexas.edu.
...