When they do that, a named device becomes an anonymous device, and falls under the control of the Default profile. You need to enable control on the Default profile.
But when you look at the logs, you’d see an unrecognized device. To discourage them from changing the MAC addresses of their devices, you can put the most strict control on the Default profile. And put named devices under more reasonable control.