value APN-Certificate

Hi,
can someone explain the added value, if I use the Apple Certificate and APN in ZMM?
I can also reset the device to factory defaults within Data-Synchronizer. In the ZMM-Console I can see in the policies from IOS-devices an inactive "Allow Profile removal" because I use a APNs Certificate and I can't set a password to remove it.
Is it a "must" to use an APN-Cert. ? What I can't do without an APN-Cert. ?

Thank you for a short explanation.

Heiko