To remove a device that has been allowlisted manually on Cisco ISE, the correct answer is option
- Administration > Identity Management > Groups > Endpoint Identity Groups. This option allows you to view and edit the endpoint identity groups that are configured on Cisco ISE, and to delete any device that belongs to a specific group.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide
/b_ISE_admin_26_byod.html

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access
/BYOD_Design_Guide/Managing_Lost_or_Stolen_Device.html#90273
The Blacklist identity group is system generated and maintained by ISE to prevent access to lost or stolen devices. In this design guide, two authorization profiles are used to enforce the permissions for wireless and wired devices within the Blacklist:
* Blackhole WiFi Access
* Blackhole Wired Access

Explanation
https://www.cisco.com/c/en/us/td/docs/security/ise/1-1-1/installation_guide/ise_install_guide/ise_deploy.html if your deployment has two nodes and you deregister the secondary node, both nodes in this primary-secondary pair are restarted. (The former primary and secondary nodes become standalone.)