Usually, not removing the AD object and revoking the certificate is not an operational problem.
Before I joined Intel, I worked 8 years at Microsoft, mainly with AD deployments and is very common creation of some kind of procedure to periodically clean up old computer and users account not used for a period of time, and you can use since vb scripts until utilities like this.
Certificate revocation is another subject: If the private key is destroyed when you make a full unprovision there is no real reason to revoke it, because revoking will not free space, it will increase the size of the CRL.
I know that each one has his own administrative policies, but if you want, a script for unprovision can be tailored to orchestrate these activities.
My two cents!
Think of a tag as a simple category name. You can categorize your documents, discussions, and blog posts with any word or words that makes sense.