If the Microsoft CA settings configure Request Handling as follows.

Parameter

Value

​Purpose

Signature​

Delete revoked or expired certificates


Allow private key to be exported


For automatic renewal of smart card certificates, use the existing key if a new key cannot be created


Do the following when the public subject is enrolled and when the private key associated with this certificate is used

Prompt the user during enrollment

As we see, the Archive subject's encryption private key option is disabled when selecting the Signature template.