Token encryption is optional: when the SP requires encrypted assertions, the SP must provide an encryption certificate (public key) in its metadata, and AD FS encrypts the assertion with that public key before sending it, with the SP decrypting it using its own private key; if the SP metadata lacks an encryption certificate while AD FS is configured to "always encrypt assertions", the token will be rejected because it cannot be encrypted.