1. This feature is only available in a PGP Universal Server managed environment. Please refer to the following KB article on how to use certificate enrollment.
2. If you want to encrypt the drive using the certificate that is stored on the smart card as an SSO user please do the following:
a) Go to the policy and select Force
the option Automatically encrypt Boot disk at installation.
c) In the require option select Supported Smart Cards for hardware security.
3. Now enroll the user.