PIN enforcement with MDM solution

I have a technical question to the android os. A phone doesn't have to have some PIN or other unlocking options but what exactly happens when you take this phone into a MDM solution such as MobileIron? It gives you some policies and somehow you are forced to take a PIN. Is this because of the policy or because of the android OS which says: "oh you want to use certificates, well I do not allow you to use them without a PIN". the phone uses wpa2-enterprise