DFCI reset verification code - where to find the documentation around this process?

I have the same issue and cannot find an easy solution especially in the scenario where the Surface device won't boot at all due to a hardware fault.   This means I can't boot to Windows to have policy changes or removal from Autopilot apply or remove settings.  

There is so much information on locking the UEFI settings but not removing in all scenarios.  I understand this may well be to do with security.  

Just to illustrate I am using this option in UEFI settings to try to generate this "validation phrase"  but who holds the validation phrase?   Is it in Azure /Entra or does it need Microsoft?