Configure > Security > Mobile Security
Enabling this option requires that all enrolled mobile devices have an individual certificate for security purposes. Devices without certificates will not receive sensitive payloads from Modern Device Management, such as Wi-Fi passwords or certificates. All devices enrolled after 2016.3 are automatically granted an individual certificate and will receive payloads. However, devices enrolled prior to 2016.1 must be manually re-enrolled to receive certificates. Certificates are uploaded and distributed to devices by mobile connectivity agent settings. For more information, see Agent settings: Mobile Connectivity.