[ZTE Axon 7 Questions & Answers] ScaryBugThing:
Thanks all - I've figured out most of these steps, including how to install Magisk successfully - only new beta versions will install, and I've only tested the 20170520 build with Magisk 13.0 beta, but it worked entirely as intended. Below are the steps needed, and below that is my old post (hidden) for posterity in case it helps troubleshoot later if something breaks. Since this has now become a guide, I will put it into the Guide section and this thread can be deprecated.

This assumes you are starting at B25, but the instructions should work for any B version number, since MiFlash is going to force us to B19.

STEP 1: FLASHING FROM B25 TO B19 USING EDL MODE:

1. Install MiFlash using the EDL thread

2. Install the QUALCOMM drivers linked in the same thread.

3. Download "B19-NOUGAT_FULL (Nougat 7.1.1)" from the same thread.

4. Extract the ZIP file.

5. Open MiFlash, selected on the named sub-folder from the ZIP

6. Connect Axon 7 via a USB cable, and hold VOL-UP/VOL-DOWN/POWER until the screen goes black and the red notification LED blinks very intermittently (~1 time per 4 seconds) to get it in EDL mode.

7. Hit Refresh in MiFlash and confirm device is shown in list.

8. Hit Flash in MiFlash to flash it. (This rolled back my B25 device to B19 stock)

9. Then do the same process again with "B19-NOUGAT_TWRP (Nougat 7.1.1)," found in the same EDL thread (to get TWRP).

Note that first I just downloaded the TWRP version, and TWRP successfully installed and I could boot into TWRP, but it would totally freeze before loading the OS ROM every time. You MUST flash the B19 FULL first to avoid this.

STEP 2: INSTALLING MAGISK 13.0 BETA WITH ROOT AND SAFETYNET PASS

1. Make sure you have a clean image with NO SU (PHH or MagiskSU or otherwise), and NO Magisk/Magisk Manager installed.

2. Enable Settings->Security->Unknown Sources in stock.

3. Download Magisk Manager 20170520 13.0 beta and Magisk 20170520 (here, and attached for convenience) (full beta thread here if needed), and copy them to your device.

4. Install Magisk Manager 20170520 13.0 beta via File Manager direct as an APK.

5. Go to TWRP, and install the Magisk 20170520 beta (here, and attached for convenience)

6. Reboot into stock, and open Magisk Manager 13.0. You should see both Magisk and Root installed (Root as "Magisksu"). If you try SafetyNet right now, it will fail.

7. Go into Settings in Magisk Manager and enable MagiskHide.

8. Now if you check SafetyNet, it should pass.

Note that the temporary beta builds appear to only be available for a short time, so either use the files attached, or go ahead and try the latest beta build. The first build I tried, 20170520, worked. My guess is all beta builds or full builds after 20170520 will work with the instructions above, but feel free to test.

STEP 3: GET OTAS: I have not tested yet to ensure Magisk doesn't break, but you should be able to download OTA packages and flash them. Will update when I care to, or others can feel free to try it and report.

Edit 5/21/2017: Added additional steps to Magisk to show process after flashing in TWRP.

Old Post (NOT CURRENT):

I unlocked my phone some time ago, but did not install TWRP or root so that I could get OTAs. I'm currently on A2017 B25 (fully up to date) and am stock otherwise. I was hoping I could get help with updated information since the guides and threads are usually old and the reply updates can be contradictory. Two questions:

1. Can someone confirm how to take my unlocked stock A2017U B25 Axon and (1) install TWRP and (2) install Magisk?

There have been a number of threads related to installing TWRP and Magisk, but all of them have question marks. The Phh Magisk guide is from 2016 so would be pre-Nougat. Then there's also a tutorial to build your own Magisk ROM, which seems like it's more complex than other people who just flash Magisk - though for them it seems like there are still problems, with it not being clear whether Magisk 10.2 or 12 is needed.

I assume I can flash TWRP using the toolkit, but it sounds like rooting via the toolkit is not going to be Magisk. I'd really like to have a root that can pass SafetyNet if needed so my device is fully functional - if there are other methods than Magisk, that'd be great too.

2. Can someone confirm what process I use to get future stock OTAs after I install TWRP and am Magisk rooted?

Do I just download the OTA file from this thread and flash it via TWRP, or do I need to go back to stock (such as with the toolkit) first?

-------------------------------------------------------------------------------------------------

UPDATE 2017/05/21:

I came very close to solving all problems. My steps are below in case anyone wants to try.

FLASHING FROM B25 TO B19 USING EDL MODE: See my explanations here: https://xdaforums.com/showpost.php?p=72294934&postcount=11

INSTALLING MAGISK 12.0 WITH ROOT AND SAFETYNET PASS

I was able to get Magisk 12.0 to run on Unlocked A2017U B19, and it appears I pass every test and Pokemon Go (test app) runs. Starting from A2017U B19 clean wipe, these are the exact steps I did. They can probably be optimized.

HOWEVER, MAGISKSU ROOT DOES NOT GIVE PERMISSION TO APPS SO THE METHOD BELOW IS NOT A SUCCESS - it says "X is denied superuser rights," without prompting. I tried all options in Magisk and could not solve this problem. If you think you can solve this problem, please feel free to give it a shot below - you will pass all status tests in Magisk but I cannot get root to actually grant access. Any suggestions?

1. Install Magisk Manager app in Google Play.

2. Boot into TWRP, flashed Magisk 10.2. Reboot. (This appears to flash successfully in TWRP, then booting back into Android it does not appear Magisk is installed in Magisk Manager).

3. In Magisk Manager, download Magisk 12.0.

4. Boot into TWRP, install/flash Magisk 12.0.

5. Boot into OS, check Magisk Manager. Magisk is shown as installed, NO root is installed.

6. Download PHH Superuser ZIP from the main post here: https://xdaforums.com/android/software-hacking/wip-selinux-capable-superuser-t3216394 (NOTE that I cannot tell which version this is. It appears to be r170 based on the changelog, but no version appears in the "superuser.zip" that I download.)

7. Boot into TWRP, install "superuser.zip".

8. Boot into OS, check Magisk Manager. Magisk shown installed, and Superuser is shown installed. SafetyNet FAILS.

9. Enable MagiskHide in Magisk Manager settings.

10. SafetyNet should PASS in Magisk Manager.

Note that I think step 2 is unnecessary, but I kept it in anyway since that's what I did exactly. Images below show the current state of things: