What happens when somebody leaves?

Their access stops, without you doing anything to the network — and within about ten minutes rather than instantly, which is worth knowing precisely.

The chain is: a sync reads account status from your client's directory every ten minutes, an account it finds disabled has its certificates revoked, and the next time that device tries to join it is refused. Nothing calls Microsoft during a handshake — a network round trip inside an EAP-TLS exchange would fail every time Graph had a bad afternoon — so what is checked on every single connection is the certificate itself: that it is one of this client's, that it has not expired, and that it has not been revoked.

This is the reason the Entra connection needs read access to accounts, and it is the whole argument for certificates over a shared Wi-Fi password: a password known by everybody who ever worked there cannot be switched off for one person.