This is a tricky one because uploading a certificate is also required. However, the question states that the Token Encryption option is unavailable. This is because the app is not added as an enterprise application. When the app is added as an enterprise application, the Token Encryption option will be available. Then you can upload the certificate. Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption