we are using Intune --> Autopilot to deploy our computers 

If you don’t update and the certificate expires. When a device enrolls will the secure boot process actually be enabled or will it fail to bind to bitlocker and take that with it in one or more policies