Hi Brian,
Active directory provides only IP, the user name and login time in events we can poll. Therefore, users are tied to IP addresses only and not to MACs whic are more unique identifiers. This of course doesn't ultimately tell you anything in case endpoint IP changes often (DHCP).
Peter