Power Platform security is like an onion--it has layers, and it doesn't exactly work with certificates.

Every user must have a license
Every user must have apps that they are using shared with them or be the owner of the apps
Every user must have access to the environment in which the app they are using lives.
This can all be automated. AD security groups can control access to environments. If the environment doesn't have CDS, then it is managed by the O365/azure ad role, if there is CDS, then it is controlled by the cds security role associated with the user or the user's team in the case of aad security group teams.