PKI Infrastructure and Configuration Manager

Hi,

I have a question regarding setting new co managed environment with cloud management  gateway.

Is there any requirement to create a PKI infrastructure in order to have a standard  on-prem, ECM environment working, along with WSUS there + CMG so that clients out of office can connect ?

I am asking because I am not sure whether PKI infrastructure is required or technology creates self signed certs somehow and we can avoid setting another part of infra there, or perhaps Azure serices can supplement us there, any hints?

Thanks.