We recently came across an issue where a customer could not sign-in to a Microsoft Surface Hub.
There’s a great article here: https://ucsorted.com/2015/08/31/understanding-user-mapping-in-a-skype-for-business-resource-forest/ explaining how a Resource Forest model works.
When you enable a SfB user, the proxyAddresses attribute is populated with the users SIP address in the format SIP:firstname.lastname@example.org. In a Resource Forest model this is populated on the disabled user object in the Resource Forest. Usually the attribute flow is one way from the User Forest to the Resource Forest so the SIP: value never populates the proxyAddresses attribute in the User Forest.
To resolve we added the correct SIP: value to proxyAddresses on the Surface Hubs AD account in the User Forest.