There are a few possibilities:
The machine was already set up before you received it — for example, it may have been opened, configured, returned, or previously assigned to someone.
Windows setup was interrupted and the device retained a partially created Windows Hello profile.
The Surface was previously associated with another Microsoft account/user.
Less commonly, Windows Hello provisioning has become corrupted.
If this was genuinely sold to you as a new Surface, I would first want to determine whether Windows is showing your Microsoft account or somebody else's account.
If you are at the Windows sign-in screen, look underneath the PIN box for:
I forgot my PIN
Microsoft specifically provides this option to reset a PIN when you cannot sign in.
Also click:
Sign-in options
and see whether you are offered the password sign-in option instead of PIN. Microsoft confirms that if PIN reset isn't available, you can use the account password and then reset the PIN from Windows.