Configure the following settings in the Request Handling tab of the Properties of New Template dialog.

Purpose

Select a purpose for the enrolled certificates.

Encryption
Signature
Signature and encryption
Signature and smartcard logon

The selected purpose alters the certificate key usage and application policies. See Extensions for how to check the key usage is among the supported combinations.

Archive subject's encryption private key

Ensure this box is not checked, as PKIaaS WSTEP ignores this setting when enabled.