yashsingh1/xdaforums huggingface dataset:
[Magisk] virags:
Hmm i actually downgrade to 17.3 which was supposed to be the stable build and tried flashing the intune hider module , still root is being detected. will check upgrading to your version and post back.

FWIW i know magisk hide is working becuase i have other apps that are using it.

Also what i dont get is why it works the first time , i can see my emails and then its like something resets and root is being detected again.
[Magisk] virags:
I tried the Magisk Version that you have and still have the same problem , initial setup and email works fine. If i close outlook and reopen it detects root.. maybe something wiht my phone ( S9+ DUos), but all other root functions and magisk hide works fine.
[Magisk] paarnoutse:
Similar issues for me with Magisk > v16.0.

Try Magisk v16.0 *and* hide Chrome.

Chrome (as WebView provider) can't be hided anymore in Magisk > v16, and when Chrome isn't hided it may cause root detection by Intune when your company also protects access to O365 internet websites (eg. SharePoint etc. and/or your Company's Intranet).

Nb.

Don't try to hide Chrome in Magisk > v16.0, because unfortunately it has the effect that hiding fails for every entry in your hide list, *and* Safetynet checks will fail.
[Magisk] agafed:
Hi.

I'm having similar issues as the ones described in this thread. The difference is that I used to have the phone rooted, but I unrooted already. However, Intune considers that the phone is still rooted or was rooted at some point. Any idea how to bypass this security alert?

Intune: v 5.0.4206.0

Cell: G965F

Thanks.
[Magisk] uofirob:
Having issues

I am on a pixel 2xl with stock room but I'm unable to get this command to work. I'm on magisk 17.3 with intune version 5.0.4206.0

Should I remove the magisk hide entry for intune that I checked before I ran the command? Is there anything else I should do first?

Thanks!
[Magisk] casouzaj:
No, you don't have to do anything, prior to entering the command. What, precisely, is not working? Have you e entered command su, then magiskhide?
[Magisk] uofirob:
Sure worked. I ran the command a second time and it says that the entry is already there. When I run the portal app to verify the device, it still started my phone is rooted. It seems like the entry isn't enough. Was there anything else I needed to do?
[Magisk] casouzaj:
I added some more entries recently. Instead of describing them, please try this Magisk module: https://xdaforums.com/apps/magisk/module-microsoft-intune-company-portal-t3780451 and report back.
[Magisk] uofirob:
I added that Magisk Module, rebooted, Enabled the module, Restarted and it sill says that the device has been compromised.

When I look back at Magisk after the restart and the module is unchecked. I've unchecked all the Microsoft apps in Magisk hide, then ran the module again, restarted and they are checked. Re-ran the device check in the Company Portal app and it still says that the device is compromised.
[Magisk] casouzaj:
These are the entries I have added to my magiskhide list:

com.microsoft.windowsintune.companyportal:omadm_client_process
com.microsoft.omadm.apppolicy.AppPolicyContentProvider
com.microsoft.windowsintune.companyportal:auth
com.microsoft.aad.adal.BrokerAccountService
com.evernote.android.job.JobBootReceiver
com.microsoft.windowsintune.companyportal.omadm_client_process
com.microsoft.omadm.origindetection.DeviceOriginContentProvider
com.microsoft.windowsintune.companyportal:fencing_client_process
com.microsoft.intune.fencing.client.FencingClientService
com.microsoft.windowsintune.companyportal/.logging.TelemetryNoticeReceiver
com.microsoft.intune.common.settings.PreferencesContentProvider

You have to run a 'magiskhide --add' command for each one of them. I think it would be better to start from the last entry to the first, and test Intune each time.
[Magisk] uofirob:
I've done all of the values, restarted and it's still saying the device is compromised. Man, why does microsoft have to be such a pain? Is there anything else I should be doing?
[Magisk] Dreamer(3MF):
Check PlayStore Device Certification Status (Google PlayStore --> Settings --> Device Certification) & Also The SafetyNet (Enable WiFi --> Magisk Manager --> Tap To Start SafetyNet Check Or Download SafetyNet Helper Sample From PlayStore).
[Magisk] uofirob:
Playstore Device certification: "Device is certified". Safetynet Check "ctsProfile: true (green checkmark), basicIntegrity:true (green checkmark)"

I'm able to use Google Pay (or whatever it's called now) and everything else... it's just this one app that isn't playing nice.
[Magisk] Dreamer(3MF):
Check The Following Points:

- Clearing Data&Cache Of Both Of Intune & Email Exchange Client (Such As Outlook & Gmail) (From Settings --> Apps --> The App --> Storage --> Clear Cache --> Clear Data)

- Installing Terminal Emulator From PlayStore --> Open It --> Write

su

--> Click On Enter --> Write

magiskhide --ls | grep omadm

--> Click On Enter --> You Will Find A Line Of

com.microsoft.omadm.rootdetection

--> Write

magiskhide --ls | grep outlook

--> Click On Enter --> You Will Find A Line Of

com.microsoft.office.outlook

- Removing Any Zip/File/Directory Which Its Name Contains The Word Of Magisk Or Anything Is Related To The Root From Internal Memory/SD-Card
[Magisk] uofirob:
I've cleared the cache on Outlook & Intune (Company Portal).

I've done the terminal calls through adb with su and I've gotten these lines:

magiskhide --ls | grep omadm

com.microsoft.windowsintune.companyportal.omadm_client_process

com.microsoft.windowsintune.companyportal.omadm.InstallReferrerReceiver

com.microsoft.omadm.client.BootReceiver

com.microsoft.omadm.client.WifiStateReceiver

com.microsoft.omadm.client.ConnectivityReceiver

com.microsoft.omadm.origindetection.DeviceOriginContentProvider

com.microsoft.omadm.preferences.preferencesprovider

com.microsoft.omadm.Services

com.microsoft.omadm.platforms.android.appmgr.state.AppStateMachineFactory

com.microsoft.omadm.users.UserManager

com.microsoft.omadm.apppolicy.telemetry.MAMTelemetrySchedulerImpl

com.microsoft.omadm.apppolicy.AppPolicyContentProvider

com.microsoft.omadm.rootdetection

com.microsoft.omadm.utils

com.microsoft.omadm.utils.PathSearchUtil

com.microsoft.omadm

com.microsoft.windowsintune.companyportal:omadm_client_process

taimen:/ # magiskhide --ls | grep outlook

com.microsoft.office.outlook

In the internal memory (when I attach phone to pc and view it) I see a MagiskManager Folder (which I assume is necessary for Magisk, as this is where the update APKs and zips are downloaded) Is it safe to rename that to something else or will Magisk just re-create it when the next update comes out?

Is there anything else I need to do?
[Magisk] Dreamer(3MF):
Maybe Intune Detects The Root Using The Following Methods:

- Checking Internal Storage For Files/Folders With Names Like Magisk, SuperSu, Busybox Or SELinux So Delete Magisk Manager Folder (P.S. Magisk Uses "Download Folder" Instead Of "Magisk Manger Folder" In The Newer Versions)

- Checking The Presence Of Other Apps Which Require Root Such As Titanium Backup

- Adding Some Devices & Fingerprints To Its Blacklist So Try DeviceSpoofingTool4Magisk From This Thread https://xdaforums.com/apps/magisk/qa-want-to-install-modules-magisk-v13-3-t3800435
[Magisk] casouzaj:
All of the sudden (no recent Intune Portal app update occurred), it started accusing that my phone was rooted. I grabbed a new logcat session, and added this new entry:

su
magiskhide --add com.microsoft.windowsintune.companyportal/com.microsoft.omadm.apppolicy.AppPolicyContentProvider

Just other 2 cents.
[Magisk] Oakley707:
Still works great on new Pixel 3 XL w/ 17.3 Magisk. Thanks a bunch!
[Magisk] paarnoutse:
Great next step in Magisk development! :good:

(latest Canary build version)

Update:

Above was just posted as info; I didn't check it out myself yet.

As reported in next post by someone who tried this, it seems that the version in current Canary build may cause problems!
[Magisk] casouzaj:
I have been using Magisk Canary builds in my Sony Xperia Z3 Compact phone, running CarbonROM 6.1, since they where released. However, with the latest build, which implemented the sub-processes hiding feature, both CTS profile and basic integrity showed false values. Thus, Intune related apps started accusing that my phone was rooted. I had to go back to the stable build (with some shenanigans along the way, which forced me to rebuild the hiding list) to get things back on track.
[Magisk] bedroidapp:
My phone would not enable data anymore after I flashed the intune magisk module. Apparently the module ends up hiding Google services and that diaables data... This will be so much better...
[Magisk] RigWig:
su

magiskhide --add com.microsoft.windowsintune.companyportal.omadm_client_process

worked for me as well
[Magisk] Kusznier:
Hi, Magisk has now rewritten magiskhide functionality ready for testing in canary channel.

Already installed. I will see if it works better than before.
[Magisk] ritzerten:
Still doesn't work for me

I am using S7 edge (exynos) with LOS 16 installed on it. Using latest version of Magisk, nothing seems to be hiding root from Intune. Even a payment app which we use here in India (BHIM) is able to detect root even though it is hidden by Magisk (magisk itself has been hidden).

In my case about 10-15 minutes after installing the intune company portal app, the phone goes into a cycle of continous restart (not bootloop) and I have to remove the app through TWRP recovery only

There seems to be nothing working as of now I guess.
[Magisk] mercrapper:
Magiskhide works on company portal

Just installed Magisk 19.3 on Moto Z Play and added company portal to Magiskhide. It works like a charm.
[Magisk] Kusznier:
Works for me for couple of months. Check the drop down in magisk hide menu in apps. Maybe you're not checking every options?
[Magisk] ritzerten:
Nope...selected every app including system apps. However, actually issue is not only that root is detecting, intune is forcing reboots on the phone making it unusable
[Magisk] Kusznier:
UH, that could definitely cause problems. Unselect everything and see if its more stable. Then work on Intune. You just need to select outlook and intune nothing more(do You use latest canary build?)
[Magisk] ram4ufriends:
I was able to use MagiskHide Props Config and update the value...but now Intune errors "You need to set a startup passcode for your device". Any idea how to bypass this? I do have a PIN setup, but still gets the error..
[Magisk] ap20001:
Can you solve this problem? I also have the same problem with you. Thank you!
[Magisk] ram4ufriends:
No... I am encrypted now as I wasn't able to resolve that
[Magisk] 白い熊:
Old thread — but I'd like to try with the edxposed SecurityBypassForCompanyPortal module. However it only patched version up to 5.0.3163.0

This apk can't be found anywhere on the web. Does anybody have this Company Portal version?
[Magisk] hallo dare:
Did you find it? I'm looking for same.
[Magisk] imneveral0ne:
Bump, just stopped working for me. Outlook randomly says I need community portal now to access my work email. I can't do anything to stop it from detecting that I'm rooted. Hid it from the app and outlook, still can't pass.
[Magisk] IlyaKol:
In early April the issue was a particular version of Company Portal after an update (few pages back on this thread https://xdaforums.com/t/module-micr...er-intune-hider.3780451/page-25#post-84877677). But now, in late April, it's forcing an update and now none of the apps will launch because of root being detected.

Not sure how to get it back to working...
[Magisk] BrimoFan123:
Facing the same issue.

I was able to open Outlook with old Company Portal 5.0.5067.0 but few days ago Outlook start saying:

"This app could not be launched because the Company Portal app on your device is out of date. To fix this problem, install the latest version of the Company Portal app."

I'm afraid that once I will update Company Portal root will be detected and Outlook won't start.

Is there a fix for that available?
[Magisk] hellfireza:
I am trying to get Teams working on my Android head unit which has a custom ROM, but isn't rooted.

Intune is flagging the OS as being rooted.

Any workarounds for this?
[Magisk] ldeveraux:
Magisk Hide?
[Magisk] Airflower:
Hi, folks. Here is the way how to start Intune and Teams on rooted phone. I did it in LOS 17.1 but I'm shure it will pass in another roms.

1. Install F-droid

2. Install Insular from F-droid, start it and make work profile.

3. Install Aurora store and clone it to work profile.

4. Download and install Intune and Teams to work profile through Aurora store.

Enjoy!
[Magisk] ldeveraux:
I didn't have to do any of that to get Intune and Teams working on either my S10 or Lenovo M10. Just Magisk and hide. done.
[Magisk] hellfireza:
But that would involve actually rooting my head unit, which is a massive ball ache.

I just want inTune to see that my unit isn't rooted (because it's not).
[Magisk] Airflower:
I had the same problem and magisk hide didn't work. Just try my variant to solve this problem. I hope it will help.
[Magisk] ldeveraux:
How can you have a custom rom of you're not at the least bootloader unlocked? If that's the case, how hard is it to root? If intune already insists you're rooted, then root and magisk hide
[Magisk] that_bad_monster:
If you want something that works, check out the post I made. Verified. Happy Hunting.

[MODULE] Microsoft Intune Company Portal Hider (Intune Hider)' https://xdaforums.com/t/module-micr...rtal-hider-intune-hider.3780451/post-85921771
[Magisk] hellfireza:
what's your variant?
[Magisk] dejson:
Well, I am little scared, rooting and modifying my phone since g1 ( yes 2008 yr ). We are using Intune, and I am afraid if I failed several times to activate Intune and to enroll device that I will be banned and warned. I am using POCO X3 PRO. Is there a way to check if I will be able to enroll my device before i actually try to enroll device. I hate locked BL and stock rom. Huge fan of MIUI but without a root it is a pain in the ass to use this device. At the end I just might get another phone for working apps only.
[Magisk] aygul12345:
Is this being solved??

Is this being solved??? Intune company portal is not listed in the hide list.
[Magisk] GoodSoul:
For those who still struggle to get Magisk and Microsoft Intune working have a look here:

https://xdaforums.com/t/tutorial-ro...t-intune-to-make-it-work-with-magisk.4402273/
[Magisk] SaKiss123:
Hi folks,

I have a non-rooted Samsung S10e with standard firmware (no LOS or anything similar) and tried to apply Airflower's solution of having Intune run in a work profile under insular. I have been able to install insular, clone Aurora to the island and download Intune Company Portal. After entering my company credentials I get a message "A work profile can't be added to this device. If you have questions, contact your IT admin."

Any idea of how to solve this? I do not want to install Intune Company Portal in the private area of my mobile.

Thanks.
[Magisk] SaKiss123:
Anyone able to help..?
[Magisk] dohanin:
Intune Company Portal has just updated to version 5.0.5556.0 this month. And it detects root now :(

Anyone able to bypass it could you share your config? which version of Magisk? MagiskHide or Shamiko or any other modules? thanks
[Magisk] skuppej:
Bummer. Indeed, I've confirmed also that this version of Teams detects root:

Microsoft Teams v1416/1.0.0.2022324202 (2022-07-13)

But this one is still working with DenyList + other protections (MagiskHide Props Config + Universal SafetyNet Fix + HideMyApplist + XPrivacyLua)

Microsoft Teams v1416/1.0.0.2022315301 (2022-07-04)

So, the only fix/workaround right now is to revert the apk to this version, clear data, apply denylist + protections, and freeze updates in Play Store.
[Magisk] skuppej:
But, interestingly, I am actually not experiencing this issue with Company Portal v5.0.5556.0 with all the protections in-place. That still seems to be working fine for me. (but I am not using a work account and my device is not managed)
[Magisk] kqueenc:
Check this out: https://docs.microsoft.com/en-us/in...ur-devices-with-inventory-in-microsoft-intune

It is much more complicated than a safetynet check. :(
[Magisk] mrhubris:
Is there any document that "maps" this towards custom ROMs?

I assume that in theory it should be possible to make a mapping between an "enrollable" device and a "non-enrollable" device...
[Magisk] Didgeridoohan:
Why would you put this on your daily driver? If your company want's you to use this, they should damn well provide you with a device as well...
[Magisk] mrhubris:
I didn't like stock so I changed it. Simple as that. I can also put it back on stock or PA (as that also works).

In a broader sense however I was wondering what the difference is between stock / PA and a custom ROM when it comes to intune and it's security checks.

The assumption is that if PA is capable of producing an "intune friendly" ROM the others in theory could as well. Only question is: how?

So we already know what intune checks. Now we need to figure out how to bypass it.

And yes, my company provides me with a phone of my choice every 2 years. That's however off topic :)
[Magisk] Nakah95:
Hi,

I'm facing the same issue with Outlook. I'm able to reproduce the same workaround (changing permissions on /sbin).

I think Company Portal is just checking the presence of magisk or su file in that folder.

There must be a way to hide those files to Company Portal ?
[Magisk] kqueenc:
I don't understand.

It should be Microsoft Intune Company Portal that is doing the compliance check and create VPN tunnel if the check passes.

What has it to do with Outlook here?
[Magisk] Nakah95:
The problem is common to all Office 365 apps (Outlook, OneDrive for Business...). These apps are using InTune to check if the device is compliant with company policies.
[Magisk] kqueenc:
In our company, IT admin allow us to use either Outlook or other email client to access exchange server.

But the prerequisite is that the device has to pass Intune's compliance check and hence be enrolled in company's white list, which my 1+3 can never do.

If I am trying to access the exchange server without passing the compliance check, access will be denied and an email will be received with following message:

"

Your mobile device has been denied access to the server via Exchange ActiveSync because of server policies.

Your device has been blocked by XXXXXs device management policy, because it is not enrolled in XXXXX Enterprise Mobility Solution.

The device therefore is no longer able to access XXXXX emails.

"

So it appears to me, that Intune is the only one that's blocking me from enroll my device to company's white list, not Outlook or any other email clients.
[Magisk] tL.Lando:
I think you are right. It is not the mail client, but the fact that the mail client is linked to Intune. I was not able to get the work-around to function properly. I noticed that my company has Intune set up so that it will check compliance on its own at random. So I can theoretically root my phone, enable the work-around, and then 2 hours later I will be blocked out of accessing my email because Intune ran a compliance check without me accessing Outlook.

At this point I have given up on root, but I will continue to follow this thread if anyone has ideas. My company appears to have some pretty strict Intune policies in place. We have to grant Intune device administrator rights, then they are able to lock, shut down, or basically do anything to our phones they wish.
[Magisk] quorn23:
The only thing that will help is an xposed module that properly stops intunes from failing (as in disable the detection checks etc), sure you might would be able to trigger a tasker-task when it starts to do the check etc but that wouldn't be a really smooth solution imo
[Magisk] candiesdoodle:
Hi [MENTION=8299105]dizzybrow[/MENTION]

Need your help!! I just got intune pushed to my oneplus3. And it is detecting root by reading the sbin folder.

Would you be kind to slightly modify your tasker app to change the permission of /sbin Only to 0750 for 25 seconds and launch outlook parallely! And share the app pls!

Thanks a lot for your help!!
[Magisk] mrhubris:
and for now it seems Magisk won't be helping either... :(
[Magisk] candiesdoodle:
But there is a solution posted already for the safteynet net trip.
[Magisk] Flight007:
I've tried everything, magisk 11, 12, 13.1, 13.2, 13.3 + safetynet fix stabe, beta 2.4, beta 2.5, also tried to flash Release_Keys_Enabler, tried the console fix, tried to recheck every checkbox in magisk manager. And yes, safetynet passing is completely not a problem, but microsoft is. Nothing. It looks like that after intune update nothing will help you. Just reflash stock ROM and cry.

And yes, I've disabled usb debugging and developer mode + unchecked installations of apks from untrusted sources.
[Magisk] kqueenc:
Same here. Microsoft is invincible.

I have to carry an old phone, just for using Intune to access mail. How sad.:crying:
[Magisk] illwafer:
do you guys need safetynet to pass or just to hide root? have you looked into SUhide?
[Magisk] prabhjots:
Why not use an app like Nine Mail, they have application level containerized security policy?
[Magisk] illwafer:
Nine works great if your company doesn't use Intune. Companies that use Intune force you to use the approved app, which is generally Outlook.
[Magisk] keon2991:
I'm using Gmail to access my corporate email, 100% compatible and no need to install Intune. You may try it.

The biggest issue for me now is Onedrive for Business - there's still no alternative :(
[Magisk] candiesdoodle:
Ok here is a sort of workaround that works for me.

1. Upon rebooting I start termux (terminal app)

2. Give su access on the shell

3. Change permission to /sbin to 754

4. Leave the app in the background.

5. When I need root access for any app, I just change the permission again to 755.

With 754, none of the non root apps, including intune and outlook, will be able to detect the su binary. Ofcourse this breaks root altogether (even for the magisk app) but assuming you want to fire up a root app occasionally, u can just re-enable the 755 perm. Once you have the app in memory after granting root access, it should continue working with root untill you exit or force close it.

In my experience, temporarily enabling root by this method doesnt effect intune or outlook. You just need to make sure you don't fire up either of those with permissions enabled.

I have been running this setup for last week or so, with no issues at all.

In fact if you see the SS, I have created two short scripts for quickly changing the permissions.

Though i do wonder how the hell is intune/ outlook able to detect the su binaries with magiskhide enabled. My company doesn't even require these two apps to be device admins!

Hope some of the learned souls of magisk can have a look.
[Magisk] kqueenc:
This trick does not work for me.

Still cannot pass Intune's compliance check: "This device has been detected as being rooted". Hell! :eek:
[Magisk] Iradj:
If you wonder why some Apps still detect root maybe it is because Magisk apparently still don't mask everything. When you run Root-Inspector and hide it with Magisk, you'll see it still detects "Deamonsu" somewhere, also now Apps detect the Magisk Manager itself.
[Magisk] candiesdoodle:
Which is this app? Can you link pls.
[Magisk] Iradj:
Just download the Apk install it, hide it and run it using Java.

https://github.com/devadvance/rootinspector/releases
[Magisk] candiesdoodle:
It's a false positive

It's just running the command "ps daemonsu" and returning an error because that syntax is invalid. The output of this command is "bad pid daemonsu"

Looking at the code .. it just thinks daemonsu exists because the return string contains daemonsu.

U can ignore this app.

But we still have the issue of outlook/intune!! Sigh.
[Magisk] kqueenc:
I am using Intune and Gmail as mail client. My company enforce us to accept these 2 app as device administrator. So I guess Intune has some other way to detect if the device has been rooted.

For example, maybe it is detecting the status of bootloader (OEM lock).