iOS 8 s/mime with Exchange

We use the configuration utility to configure our iOS devices. For Exchange we use certificate authentication only and are trying to configure s/mime. It is working as expected, however I was wondering if there is a way to enable s/mime form the profile yet have the user set the option to encrypt or not with out requiring encryption as default. I have tried assigning a cert to only sign the email and not assigning a cert to encrypt. I also looked at the xml file. Is looks as if you set s/mime in the profile it defaults to both sign and encrypt. Is this correct?