To be better able to manage devices (badges) like how Maas360 manage iPads. Maas360 automatically manages getting a certificate from Active Directory on a device and use SCEP to maintain the certificate. That same capabilities are required.