You have to tell the end device to use EAP-TLS. Otherwise, it will likely default to PEAP and continue with username/password.
If you found this post helpful, please give it Kudos. If my answer solves your problem, please click Accept as Solution so others can benefit from it.