Microsoft Surface Hub 2 SmCamera - Manual (Page 368)

Due to the limited number of policies the Surface Hub device account supports, it
commonly needs to be excluded from Conditional Access policies to allow sign-in. To
exclude the device account from a Conditional Access policy do the following:
1. Under Assignments, select Users > Exclude
2. Select Users and groups
3. Select each individual Surface Hub device account, or group of device accounts.
4. Select Save at the bottom of the screen.
Here's a video demonstrating how to exclude user accounts from a Conditional
Access policy.
７ Note
Policies in On or Report Only states can affect the Surface Hub device account.
Exclude device account from unsupported
Conditional Access policies