it is incredibly tedious to have to assign users to devices individually, during initial deployment of 500 users this is a killer but more over having to do this on per new device ingested lack imagination surrounding automation.

If AD has been synced why not use this data to help link devices.