These are devices that have been authenticated or have logged in. The ID column shows how a device has been authenticated. This may be via MAC address, via the login page by a user, or via a token. Click on the icon to see options.

These are devices that are on the network but may have not been identified or authenticated. The default policy will apply until a device is authenticated.