I'm not sure if I'd call it a 'native' functionality, but its not an uncommon thing to do.
The basic mechanism by which you would accomplish this type of authentication is to use machine certificates. By leveraging your active directory as a PKI environment, you can deploy machine certificates to every Windows machine.
Once you have deployed machine certificates, you'll configure a RADIUS server like Cisco ACS or Cisco ISE that will perform EAP-TLS authentication against those certificates.
So you'll set up your SSID to perform EAP-TLS authentication, point the authentications to Cisco ISE, and install the root chain certificate from Active Directory on your ISE machine and set up a few rules that authenticate and authorize access when a valid certificate is presented. Finally you'll configure your Windows machines to connect to the SSID using EAP-TLS and to offer their machine certificate during that authentication process.
If you've never done any of this, you'll either want a fair amount of lab time or better yet find a Cisco partner to help you set it up. It's not terribly difficult but there are a fair amount of moving parts that make it more complicated than just a checkbox or something.