802.1x authentication for non domain joined devices

Hi,

 Currently we authenticate network devices - printers, scanners, etc using 802.1x with MAC address bypass whereby we enter usernames against MAC addresses in AD for each device. This is clunky and not ideal. I'm looking for a solution which can roll out certificates to printers, scanners, thin clients, etc in a secure and manageable way.

What's the recommended way of achieving this?

Thanks