Device certificates or user certificates: what's the difference?

A device certificate says this machine may use the network. A user certificate says this person may use the network. The difference decides three things: whether a machine can connect with nobody signed in, whether access follows a person between devices, and what you can put on a VLAN.

You don't have to pick one. Every new client gets an authority that issues both, so the question is which to use where.

Use device certificates where you trust the machine: shared laptops, kiosks, a warehouse PC that has to be on the network before anybody signs in, anything unattended. A device certificate connects at the sign-in screen. A user certificate can't.

Use user certificates where you trust the person: staff with their own laptop and phone, contractors, anyone whose access should follow them and stop when they leave. It's also the only way to choose a VLAN by who someone is. A device certificate has no user, so a shared laptop gets the same VLAN whoever is using it.

Both come from the same authority, so there's nothing extra to distribute. Your MDM gets a user profile and a device profile, and you deploy each where it fits. You can even use two SSIDs, one for device certificates and one for user certificates, with the same authority behind both.

One thing to know before you choose: Intune compliance can only be enforced on a device certificate. A user certificate has no device to look up. If a client wants non-compliant machines refused, it needs device certificates.