Device certificates or user certificates — what is the difference?

A device certificate says "this machine is allowed on this network". A user certificate says "this person is allowed on this network". The difference decides three things: whether a machine can join with nobody signed in, whether access follows a person between devices, and what you can steer onto a VLAN.

You do not have to choose. Every new client gets an authority that issues both kinds, so this is a question about which one to deploy where rather than which one to set the client up with.

Deploy device certificates where the machine is the thing you trust: shared laptops, kiosks, a PC in a warehouse that reboots and needs to be on the network before anybody logs in, anything unattended. A device certificate joins the network at the login screen, which a user certificate cannot.

Deploy user certificates where the person is the thing you trust: staff with their own laptop and their own phone, contractors, anybody whose access should follow them and stop when they leave. It is also the only way to steer a VLAN by who somebody is — a device certificate has no user attached, so a shared laptop gets the same VLAN whoever is sitting at it.

Both kinds come from one authority signing both, not from two authorities — so there is no extra trust material to distribute and nothing extra to keep in step. Your MDM gets a user profile and a device profile, and you deploy each where it fits. You can even point them at two different SSIDs: one for device authentication, one for user authentication, using the same certificate authority underneath.

One catch worth knowing before you choose: Intune device compliance can only be enforced on a device certificate. A user certificate carries no device identity, so there is nothing to look up a compliance verdict against. If refusing non-compliant machines matters to a client, that client needs device certificates.