nono, you can also manually access each endpoint and boot it in safe mode and delete one file. but you cannot do it remotely. and not if you are using some cloud service, like aws.

I've seen instructions for AWS, since you can unmount the data store from the machine, mount it on another and do the fix there.

Also if bitlocker key repo is borked. In which case this may be the only chance at recovery.