Can Passbeam put different people on different VLANs?

Yes, by Entra group, with rules that are ordered and where the first match wins — so somebody in two groups lands somewhere you can predict from the page rather than somewhere you have to work out.

One limitation to design around: steering by *person* needs user certificates. A device certificate has no user attached, so a client on device certificates can be steered by device group but not by who is signed in — and a shared laptop gets one VLAN whoever is using it. Entra device groups are the direct analogue and work well for most cases.