The following Conditional Access policies (https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview) are applied to the utexas tenant in Azure Active Directory.
Microsoft Surface Hubs are not compatible with Conditional Access Policies and are unable to authenticate unless they are manually excluded from every policy (https://docs.microsoft.com/en-us/surface-hub/create-and-test-a-device-account-surface-hub). The exclusion group is 99a683be-a6a4-45d0-9bff-555a0f6d319c / Surface.Hub.Conditional.Access.Bypass.Group@austin.utexas.edu.