If I only set Configure Microsoft Update Managed Opt In to Enabled, is that enough for my managed devices to install the cert updates when Microsoft deems it safe to do or do I also need to set Enable Secure Boot Certificate Updates to Enabled simultaneously? It seems like the Enable Secure Boot Certificate Updates setting will start the process immediately.