Ok, so I set up a config in my lab to test what may at fault here for you.  Since you are using Unity Connection, you do have the ability to configure Connection-specific Partitions and Calling Search Spaces.  In other words, the concept and components to create a multi-tenant dial plan are built into the system.  If you don't have these objects configured properly, it will cause issues with various functions including caller system transfer.  So, let's start with a few questions regarding your configuration.

1) Open Dial Plan > Partitions.  You will have at least 1 default partition typically named Partition where is the host name of the Unity Connection server.  If you only have the default partition, then you can just confirm (i.e., don't need the name of the partition).  If you have other partitions that you have created, then list each one by name.

2) Open Dial Plan > Search Spaces.  You will have at least 1 default search space.  Like the default partition, it will be named as Search Space.  If you only have the default partition, then you can just confirm.  If you have other search spaces that you have created, then list each one by name.  In addition, please provide the following information for all search spaces (including the default):

     - Within the configuration for each search space, please list the partitions selected in the "Assigned Partitions" field.

3) Open System Settings > General Configuration.  Please list the name of the partition specified as the "Default Partition" as well as the search space specified as the "Default Search Scope".

4) Take a look at the User configuration for some of the users you have tried transfer to and failed.  From the Edit User Basics configuration page, list the name of the partition and the search space configured for the user.

5) Open System Settings > Restriction Tables.  If you are using the default restriction tables, open the "Default System Transfer" table.  Please verify that the last entry (order 4, by default) has the "Blocked" box UNCHECKED and the pattern listed is a single wildcard (star, *).  If you have created custom restriction tables, you need to ensure that you are allowing either a similar configuration (*) or a sufficient pattern for callers to enter digits and have Unity Connection match upon (ex: ????* would mean callers have to enter at least 4 digits for a match to occur).  It would also be prudent to take a look at the Default Transfer table and verify it is configured in the same manner.  For end users, this restriction table (Default Transfer) is set as the default for Transfers in the default Class of Service configurations (and when creating new CoS in CUC).

6) Open System Call Handlers and select the AA in question.  On the Edit Call Handler basics page, please indicate how the Search Scope is configured.  By default, it should be set to "Inherit Search Space from Call".  If it has been configured to a specific Search Space, please indicate the name of the search space.