What is configured to enforce the blocklist permissions and deny access to clients in the blocklist to protect against a lost or stolen device obtaining access to the network?

The My Devices portal is where users manage their own registered devices, not where blocklist enforcement rules are configured.

A 'blocklist portal' is not a standard or direct mechanism in ISE for enforcing blocklist permissions.

An Authentication rule determines if a user or device is who they claim to be, but it does not specify what level of access they receive or if they are blocked.

An Authorization rule in Cisco ISE determines what network access a client is granted or denied after authentication. To enforce a blocklist, an authorization policy is specifically configured to match clients present in the blocklist and assign a 'Deny Access' or highly restricted result, effectively preventing them from gaining network access.