Disable management frame protection on the affected SSID.
1. Click on the VNS
2. Click on WLAN Serivces
3. Select WLAN that Microsoft Surface is not connecting on
4.Select the Privacy
5. In the Management Frame Protection drop down select Disabled
UPDATE (17-Mar-2017) - please upgrade to 9.21.16.0013. If there are continued problems with the Surface Pro connecting, please contact our GTAC Support Desk and open a case. How to contact Extreme Networks Global Technical Assistance Center (GTAC)