It's definitely not limited to a single device. A user should be able to register multiple devices and the string in AD is just delimited.