The following Conditional Access policies (https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview) are applied to the utexas tenant in Azure Active Directory.
Microsoft Surface Hubs are not compatible with Conditional Access Policies and are unable to authenticate unless they are manually excluded from every policy (https://docs.microsoft.com/en-us/surface-hub/create-and-test-a-device-account-surface-hub). Exclusion Group: 99a683be-a6a4-45d0-9bff-555a0f6d319c / Surface.Hub.Conditional.Access.Bypass.Group@austin.utexas.edu.