Edit

Share via

Troubleshoot access to Settings app on Surface Hub

  • Article

To open the Settings app on Surface Hub, select All apps > Settings. Ease of Access settings are available to anyone using Surface Hub. For all other settings, select View as Admin and sign in with an Admin account. If you're unable to access settings after attempting to sign in with your Admin account, review the troubleshooting guidance on this page, beginning with Device affiliation.

Device affiliation

Full access to the Settings app on Surface Hub depends on how you initially affiliated Surface Hub during first run setup (aka OOBE) via one of the following options:

Microsoft Entra ID

By default, when Surface Hub is joined to Microsoft Entra ID, only an account designated as a Global Administrator (GA) in your Azure tenant can access Settings. If unable to access Settings, check the following issues:

  • Is the account a Global Admin account?
  • Is the password expired? Try resetting the password.
  • Is Surface Hub connected to the internet?
  • Is Surface Hub behind a proxy or firewall that blocks access to Microsoft Entra ID?
  • Did you or another admin configure non-Global Admin policy for Surface Hub? If yes, see the following section.

Important

Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role. To learn more, see the recommended guidance in Configure non-Global Admin accounts on Surface Hub.

Troubleshoot non-Global Admin policy

When joined to Microsoft Entra ID and auto-enrolled in Intune, you can configure non-Global Admin policy to allow other accounts to access Setting on Surface Hub. If non-Global Admin policy is enabled and users can't access Settings, check the following issues:

Policy succeeds: Still no access to Settings

If Intune shows the non-Global Admin policy setting is successfully applied to Surface Hub:

  • Is the account attempting to sign in a member of the security group designated for this policy?
  • Is the Surface Hub connected to the internet?
  • If a GA account is being used, is it a member of the security group configured on the Surface Hub? GA accounts must also be added to this security group. Otherwise, if non-Global Admin policy is applied to Surface Hub, the GA can no longer access Settings.

Policy fails: Intune error

If Intune shows the non-Global Admin policy setting fails to reach Surface Hub:

To learn more, see Troubleshoot policies and configuration profiles in Microsoft Intune

On-premises AD

If the Surface Hub is domain joined and connected to on-premises AD, a security group in AD is specified during first-run setup to allow group members to sign into Settings. This designated group can be seen on Surface Hub within Settings > Surface Hub > Accounts. If an error message is received stating “this requires elevation” when attempting to log into Settings, check the following issues:

  • Ensure the account being used is a member of the security group designated during OOBE.
  • Ensure the account is enabled and the password hasn't expired.

Note

If the Surface Hub loses trust with the domain and Settings can no longer be accessed, you will need to reset Surface Hub.

Local admin - no device affiliation

If you choose to set up Surface Hub with a local admin (no device affiliation to Microsoft Entra ID or on-premises AD), the account created during first run setup is the only account that can access Settings. The local admin account is not backed by any directory service. If the credentials are forgotten or no longer working, you'll need to reset Surface Hub.

Important

If the local admin account was created using a provisioning package, the password must be reset every 42 days. Otherwise, the account may be locked out and unable to sign into Settings. If this occurs, you will need to reset Surface Hub.

Learn more