In my previous blog post here: http://blogs.msdn.com/b/alex_semi/archive/2013/08/12/start-mbam-encryption-on-bitlocker-pre-provisioned-and-windows-to-go-drives.aspx?CommentPosted=true#commentmessage
I talk about starting MBAM encryption as a part of SCCM Task Sequence, saving the key to MBAM database. Apparently, the script did not work on Surface Pro or pretty much any other tablet - it needs one more registry key under Policy\FVE - OSEnablePrebootInputProtectorsOnSlates
I added this key and it fixed the problem. The version was updated.