Disk Encryption

Hi ElieAT! My answer would be: it depends. That's not very helpful, though :). In my opinion, disk encryption is a configuration that is tied to a device, so I would assign it to a device.

Should you, however, have a use case where this configuration should apply to any (enrolled) device the user logs on to: assign it to users. I just really can't think of any reason you'd want that.