Q:

client certs appear to be accessible even after removing them from APIM

I've been playing around with Azure's API Management service and came across some unexpected behavior.  Specifically, I've been reading about using certs for client authentication as discussed here.  I'm interested in checking the incoming thumbprint against the certs already uploaded to API management.  The Azure example gives you the following example for achieving this:
<choose>
<when condition="@(context. Request. Certificate == null || ! context. Deployment. Certificates. Any(c => c.Value. Thumbprint == context. Request. Certificate. Thumbprint))" >
    <return-response>
        <set-status code="403" reason="Invalid client certificate" />
    </return-response>
</when>

Using Postman and some mocked responses on the API side this works as expected.  Incoming messages that have the cert work and others return a 403.  What is odd is I then removed the cert from the Client Certificates page on the Azure API Management portal and my request from Postman still makes it through.  I was expecting them to be rejected since the cert is gone. 
Removing the cert from Azure was successful, at least according to the notifications presented to me in the portal.  I also tried it again after an hour or so thinking that it might need sometime to process. 
Thank you all for your time! 

A:

This is a known issue, and will be fixed shortly.  For now you'll have to change, for example, policy to force APIM to throw away certificate from runtime.