SCEP Certificate Hybrid Azure AD Prelogin.

Do you need the SCEP certificate for Hybrid Azure AD device for pre-login if we need to get the VPN client to authenticate and get the device to see the domain controller?