[Xposed Framework Modules] bqw371:
Without the RootCloak xposed module hiding root from the MobileIron app (com.mobileiron), it will detect root apps such as SuperUser, SuperSU, RootCloak, etc, marking the device registration as compromised. Even with the RootCloak xposed module, MobileIron can still detects root access on devices. MobileIron was notified through responsible disclosure a couple years ago that it was possible to hide root access using RootCloak Plus + Cydia SubStrate and the root detection has since been strengthened. The exact methods used to detect root are not shared by MobileIron though there are a few ways to determine what they do check for and detect.

MobileIron provides a sample root detection app to customers titled "RootCode.apk" (com.eample.adroid.skeletonapp). This app is designed to be ran on a users device that is marked as compromised. The app outputs why the device is marked as compromised by MobileIron. Often non-rooted customers have root capable apps installed from the Google Play Store. MobileIron sees a root capable app on the device and marks the device as compromised though it could be considered a false positive since the app itself does not represent the root status of the device. If this non rooted example device uninstalls the root capable app and the RootCode.apk no longer marks the device as rooted, then the user can register to MobileIron without issues.

On a rooted device, if root access is hidden from the installed sample RootCode.apk via RootCloak xposed module, the following message is generated by RootCode.apk: Status code: 2. Root Cause: packages list was tamperedmodCount

I assume this occurs due to the difference between the application ArrayList and modCount. I would imagine that the MobileIron app itself has more robust root detection methods but the sample APK gives some hints as to what is being looked for to determine root status.

Here's a list of apps that the sample RootCode.apk searches the device for:

com.googlecode.android.wifi.tether

og.android.tether

net.snclab.wifitetherrouter

com.topapploft.wifi.tether

org.jaconet.fixtether

net.szym.barnacle

com.androidactivity.tetherWifi

net.kernelxp.freetether

com.formichelli.tetheringfix

com.matsoft.freetetheringfix

me.eugeniomarletti.tetheringfixer

ca.mahram.tjelly

net.clearcontrast.remote

com.ryanamaral.wifi.passwords

com.ryanamaral.wifi.passwords.donate.version

eu.chainfire.pryfi

uk.co.opticiancms.wifiprobe

com.noshufou.android.su

com.noshufou.android.su.elite

com.noshufou.android.su.fixer

com.koushikdutta.superuser

com.bitcubate.android.su

com.bitcubate.superuser.pro

com.bitcubate.android.su.installer

eu.chainfire.supersu

eu.chainfire.supersu.pro

jp.uchicrew.start.addon.superuser

com.androidrootuser

com.qine.su

com.gorser.superuser

david.lahuta.superuser.free.pro

david.lahuta.superuser

com.asuperuser.su

com.amphoras.hidemyroot

com.zachspong.temprootremover

com.formyhm.hideroot

net.snclab.RootKeepSurvival

com.troy1103.hideyourroot

eu.chainfire.triangleaway

com.itydevs.roothiderlite

com.itydevs.roothiderpremium

com.amphoras.hidemyrootadfree

stericson.busybox

stericson.busybox.donate

com.lukemovement.roottoolbox.free

com.lukemovement.roottoolbox.pro

sa.root.toolkit

com.jrummy.roottools

nextapp.fx.rr

eu.chainfire.mobileodin

eu.chainfire.mobileodin.lite

eu.chainfire.mobileodin.pro

com.devasque.fmount

stericson.xda.metamorph

com.hexamob.hexamobrecoverylite

com.rootlandscn

com.siriusapplications.quickboot

com.siriusapplications.quickboot.plus

com.koushikdutta.rommanager

com.koushikdutta.rommanager.license

com.speedsoftware.rootexplorer

com.traber.systemappsinstaller

com.jrummy.apps.boot.animations

com.jrummy.root.browserfree

de.bwulfert.suchecker

one.two.reboot

com.jrummy.apps.rom.installer

zsj.android.uninstall

com.mhuang.overclocking

com.antutu.CpuMaster

eu.chainfire.cf3d

rs.pedjaapps.KernelTuner

com.martino2k6.vmheaptool

com.oasisfeng.greenify

org.freecoder.widgets.overclock

lv.n3o.lcddensity

com.bw.picme.local

com.tools.screenshot

com.bigtincan.android.adfree

com.notenking.mf

com.skvalex.alsamixer

com.keramidas.TitaniumBackup

com.h3r3t1c.onnandbup

com.rerware.android.MyBackupRoot

com.rootuninstaller.free

com.rootuninstaller.pro

com.ramdroid.appquarantine

org.projectvoodoo.otarootkeeper

david.lahuta.restarter.free

com.root_backup_free_10

eu.thedarken.sdm

de.mehrmann.sdbooster

eu.chainfire.stickmount

com.slf.ListglApp

net.shajul.usbotg

uk.co.mytechie.setDNS

com.rootuninstaller.firewall

org.jan4984.webrd

fahrbot.apps.rootcallblocker.pro

fahrbot.apps.rootcallblocker.beta

fahrbot.apps.blacklist

com.jrummy.font.installer

com.lee.android.switcher

com.janis605.softkeyz

com.goodmooddroid.gesturecontrol

com.webkey

com.ne0fhykLabs.android.utility.kmLauncher

com.whitedavidp.keyboardmaster

com.gagan.free.xram

com.gejos.android.rambooster

com.gejos.android.rambooster.donate

org.azasoft.free.swapper

de.robv.android.xposed.installer

com.devadvance.rootcloak

com.geohot.towelroot

com.stump