We have added limited support for Cryptography: Next Generation (CNG) certificates in Update 1710 for System Center Configuration Manager Technical Preview. Now Configuration Manager clients can use PKI client authentication certificate with private key in CNG Key Storage Provider (KSP).
With KSP support, Configuration Manager clients can now support hardware-based private key such as TPM KSP for PKI client authentication certificate.
Read about it in the Enterprise Mobility and Security blog.