have hotspot running on CCR, user profile allows 3 devices per user. But currently the limit on bandwidth is per device not per user. so each user may get 3 x of what is allowed. any thoughts?

If you know the MAC's of the devices tied to the user, you would have to write specific queue rules to limit each MAC/Device. There is no specific way to aggregate the users devices into one rule when you are using the hotspot configuration to apply a dynamic rule, that I know of. Maybe a script could take of this for you.

This is typical task for a (free-)radius server as backend. Dunno how to interface to RoS, though. openwrt/LEDE is better suited to special hotspot configs, like this one.

will give the Radius option a try, we are using DMA radius for other customer. would prefer to keep authentication on the Mikrotik though.

as for script, I guess it can create a parent queue for every user and add all devices of this user to that queue. bit over my head...

DMA Radius (based on free radius) is not able to do this.

tried to create user profile per user (match this with a parent queue) and then add each multiple user device to this profile. However "parent queue" in user profile does not show any queues in Queue Tree but only show items in Simple Queue.

There must be a solution? Any one?

DMA Radius (based on free radius) is not able to do this.

I am wondering. The limitations is RoS, I strongly suspect. As Radius can control a lot of various quota policy.
You are another example, that RoS is not the best choice for hotspots with special requirements.
openwrt/LEDE + freeradius backend definitely is able to do the job.

https://www.youtube.com/watch?v=jgDYClRGjvI

Check this video

Login script

# Set Default Rate Limit k/s #Set User # Set User Profile
:global DRateLimit "9000"
:global UName "asd"
:global ProName "MultiShare_Pro"

# Remove Default Queue
/queue simple remove [/queue simple find name~"$UName"]

# Count Login Device
:local DeviceCount [/ip hotspot active print count-only where user=$UName]

# Set Queue Per Device
:local QPerDevice ($DRateLimit / $DeviceCount)

# Add Queue to New Login Device
/queue simple add name=$address target=$address max-limit=($QPerDevice."k/".$QPerDevice."k") comment=$user place-before=0;

# Reset Queue to Logined Device
:foreach QReset in=[/queue simple find comment =$UName] do={/queue simple set $QReset max-limit=($QPerDevice."k/".$QPerDevice."k")}



Logout Scrip:

# Remove Queue From Logout Device
/queue simple remove [/queue simple find name =$address]

# Count Device Login
:local DeviceCount [/ip hotspot active print count-only where user=$UName]

# --------------------if all Device Logout

:if ($DeviceCount =0) do={

:log info "All are Devices Logout "

}\

else={

# Set Queue Per Device
:local QPerDevice ($DRateLimit / $DeviceCount)

# Reset Queue to Logined Device
:foreach QReset in=[/queue simple find comment =$UName] do={/queue simple set $QReset max-limit=($QPerDevice."k/".$QPerDevice."k")}

}