Remotely change bitlocker PIN of fired employee

Hi all,
I have a case in which an employee was fired and I need to block his access to the laptop.
Laptop is managed via intune - azure-joined.
So of course the account was locked, mobile number updated to block pass resets, forced sign out of all sessions and mfa was revoked  - but I could not find a way to remotely change the bitlocker PIN so he can't boot the laptop (Maybe trying to access using other accounts or local ones).
Rotating keys doesn't affect the PIN...
any ideas? What would you do in such case?
Best,
Sean