802.1x certificate revoke

Yes, provided your RADIUS server is configured to perform certificate revocation checking.

In a typical Microsoft PKI + NPS (RADIUS) + 802.1X EAP-TLS deployment, when you revoke a device certificate on the CA, the certificate serial number is added to the CA's Certificate Revocation List (CRL). During a future authentication attempt, NPS validates the client certificate chain and checks the revocation status against the CRL (or OCSP if deployed). If the certificate is found on the revocation list, authentication is denied.

The important detail is that revocation is not instantly pushed from the CA to NPS. NPS relies on the CRL it can access and cache. If you revoke a certificate today, the device may still authenticate until a new CRL is published by the CA and the NPS server retrieves the updated CRL. Microsoft specifically notes that a revoked certificate can continue to work until the updated CRL becomes available to NPS.

Therefore, if a stolen device must be blocked immediately, the PKI administrator should revoke the certificate, publish a new CRL immediately, and ensure the NPS server can retrieve the updated CRL. You should also verify that NPS revocation checking has not been disabled through its CRL-related registry settings.

As a defense-in-depth measure, many organizations also disable or delete the computer object in Entra ID/Active Directory and retire or wipe the device from Intune in addition to revoking the certificate, rather than relying solely on PKI revocation.