A challenge password for SCEP clients. 

This setting only applies to requests sent through the SCEP Service. It does not apply to requests sent through the Intune-SCEP Service because Microsoft Intune validates these requests.

Mandatory:  When the Insecure SCEP (Permit an empty challenge password) box is not checked.