If you are doing certificates with verification - the root certificates and client certificates must be pre-loaded (or done manually after the device is online).
If you are using the TMSPE solution - the phonebooks will function through the VCS without any additional pinholing. The phonebooks will be delivered over the SIP connection.