1. Adjust the network interfaces to allow encrypted calls.
2. Set Group properties.
Generally set encryption to “Enable” and allow users to change. An exclusion to the rule would be medical environment, government or military where you would want to force on. Or folks with low end computers, where you would turn off to reduce processor load.