I agree with Simon.
Not only the reset is a pain (but let's say it could be understandable, and doable by an employee, because it uses the Windows UI), but 4 years ago, we asked MS product group to know if we can dump the existing hardwares hashes directly using GraphAPI. As of now, there is still no way to do that.
The recommended way is to run Get-WindowsAutoPilotInfo script, or to rely on the builtin Windows Settings/Accounts/Access Work or School/Export your management log files button, and ask the user to send the CAB file to the Intune admin (BTW, why CAB format??? Can't you just ZIP? What if I need to open a CAB file on Linux to get the CSV hash file, in case of automation done with a web service running on a Linux backend, that would do the job of dealing with the access to the source and destination tenant?).
😞