yashsingh1/xdaforums huggingface dataset:
[Magisk] Didgeridoohan:
If this works with Tez as well, you can try the custom built Magisk provided earlier in the thread. It does the same as the provided module, but for all apps on the Hide list.
[Magisk] Mithun rascal:
I tried mate, it doesn't work. :(
[Magisk] Dreamer(3MF):
Kindly Check This Post https://xdaforums.com/apps/magisk/tez-app-custom-rom-root-device-t3722018/post76261059
[Magisk] Airpil:
Dreamer(3MF), i am using Android P. Could you please give an advice how i can overcome OS version check with Magisk. According to Intune Portal i am using version below 4.4 ( which is obviously not true). Current OS version is P.
[Magisk] Dreamer(3MF):
Kindly Send A Copy Of

build.prop

File Of Your Rom To Check It Firstly
[Magisk] Dreamer(3MF):
You Are Using A Beta Version Of Android P Which Doesnot Support Until Now Some Classes/Functions Which In This Case Returns A Fault. And Due To Intune App Doesnot Cover Also The Changes Of Android P, It'll Refer This Fault To One Meaning Only That The Current Android Version Is Below 4.4 (Kitkat). I Expect Intune App To Be Updated Within The Next 8 Months To Support The New Android Version (Android P).
[Magisk] Airpil:
That is exactly the question how can i change OS version with Magisk? To pretend to be a 8.1.0 instead of P.
[Magisk] malacoid:
Thank you so much for making this module! I didn't have success until I hid root from Gmail, which is what I check Exchange with.
[Magisk] amw2320:
I don't think this is possible for you. You have 3 incompatible problems:

1. InTune does not recognize your version of Android.

2. Magisk needs to be running to mask your android version.

3. MagiskHide needs to "disable" and revert Magisk while InTune is running.

You could probably change you build.prop or some other settings to make InTune think you are running Oreo or another acceptable android version. However, Magisk needs to hide itself to pass the InTune compliance check. As soon as InTune starts, Magisk will hide and restore your original build.prop. In that scenario, InTune won't see root, but it will see the an incompatible android version. If you don't use MagiskHide, InTune will see a compatible Android version, but will fail at the root check.

I don't know if there is a way to preserve some build.prop settings during MagiskHide. It may be worth exploring, but even if it's possible, you still may fail as your build.prop fingerprint would not pass SafetyNet.

You best bet is probably to move to a non development build of Android.
[Magisk] Airpil:
The thing is that I have Magisk and MagiskHide installed device pass SafeNey test, and I like P because it works really good with Bluetooth devices. With the latest version of the module I was able to hide a root. And the only one thing is OS version...
[Magisk] Dreamer(3MF):
The Main Problem Is Not How We Can Create/Make A Module To Mask/Cover The Current Android Version But How We Can Provide It With The Functionality Of The Missed Ones
[Magisk] grilledbacon32:
Anyone update the Intune app? Does it cause any issues with the module??
[Magisk] candiesdoodle:
No issues
[Magisk] rajackar:
Major thanks for creating this!!

Works like a charm on my rooted device.

Of course I still needed to accept the security policies and device admins. Do you know if there's anyway to override these when rooted? I'd love to keep my smart Lock enabled and my corporate policies disable this.
[Magisk] Dreamer(3MF):
Thanks For Using The Module. You Can Update Intune App As You Want Without Any Effect On The Module Unless The Changes Of Intune App Are Related To The Root Detection. But Everyone Here Will Help Us To Figure Out The Solution.

---------- Post added at 11:17 PM ---------- Previous post was at 10:53 PM ----------

Thanks For Using The Module & Your Kind Words. Actually I Don't Know How To Override The Security Policies & Device Admins To Use Your Smart Lock App. But I Will Search About That.
[Magisk] Dreamer(3MF):
Microsoft Intune Company Portal Hider Module Has Been Updated. Try It & Awaiting The Feedback. Check This Link https://xdaforums.com/apps/magisk/microsoft-intune-company-portal-t3611588/post76210193.
[Magisk] grilledbacon32:
Is there a change log? Ever thought about making the module it's own thread, it'd be easier to direct to when there are updates.
[Magisk] Huza91:
Hey all,

I've been following this thread since it started and I must say well done to all those involved!! You don't get the credit you all deserve!!

Anyway, I'm having an issue when enrolling my device.

I did a clean install of a custom rom, installed magisk 16.2, installed Outlook & Intune, installed the new version of the intune hider, hid Outlook and Intune.

Am I missing something?

Thanks guys!!
[Magisk] Dreamer(3MF):
Thanks For Using The Module. Could I Ask You For Giving More Details About The Issue? And Did Your Phone Pass The SafetyNet?

---------- Post added at 04:52 AM ---------- Previous post was at 04:38 AM ----------

Kindly Check This Thread https://xdaforums.com/apps/magisk/module-microsoft-intune-company-portal-t3780451#post76303443.

---------- Post added at 05:52 AM ---------- Previous post was at 04:52 AM ----------

Kindly Check This Post https://xdaforums.com/apps/magisk/module-microsoft-intune-company-portal-t3780451/post76295000.
[Magisk] Huza91:
Right so when I'm enrolling my device, I get an error stating "Couldn't add your device"

So just to be clear

Fresh custom rom installed

Magisk 16.2 installed (Came as stock with Ambasadii rom for S8)

Outlook installed

Intune installed

Intune hider flashed

Outlook and Intune hidden in magisk

Safety net passed

I haven't a breeze where I'm going wrong guys
[Magisk] Dreamer(3MF):
Try The Following

- Sign In To Office 365 & Make Sure That The License Which Includes Exchange Online Has Been Assigned To The User Who Is Signed In To The Device.

- Enable/Disable Device Administrator Settings For Intune & Outlook.
[Magisk] Huza91:
Yeah I have an Office 365 E3 and EMS licence.

Intune enrols successfully on a stock rom so it's not an issue with my work account.

There's something I'm doing wrong but I can't figure out what.

Should I be using the patched binary and the hider?

Should I install the apps and flash the hider in any specific order?
[Magisk] Dreamer(3MF):
Send Your Answer For The Following

- What Is Your Phone Model? And What Is The Installed Custom Rom?

- Did You Installed BusyBox/Xposed? And If So, Disable/Uninstall BusyBox/Xposed.

- Try This Module SELinuxModeInverter4Magisk-v1.0.2(v1500)(3MF).zip.

- Try The Patched Binary.

- Full Logcat Is Required.
[Magisk] Huza91:
- What Is Your Phone Model? And What Is The Installed Custom Rom? Samsung Galaxy S8 G950F with Ambasadii 3.4 Custom Rom

- Did You Installed BusyBox/Xposed? And If So, Disable/Uninstall BusyBox/Xposed. Busybox removed (Xposed not installed)

- Try This Module SELinuxModeInverter4Magisk-v1.0.2(v1500)(3MF).zip. Tested and same result

- Try The Patched Binary. Tested and same result

- Full Logcat Is Required. How do I do this?

I honestly have no idea how it's working for others but not me on a clean OS install ??
[Magisk] amw2320:
Sounds like you've done everything. Does it give you any other message as to why it can't be added? I just had to jump through some hoops because my account had too many devices registered. Usually if it detects root, there is a message that says "your device is not in compliance", with a drop-down showing a message that your device is rooted.
[Magisk] Huza91:
Yeah I've removed all devices from intune. Should I have both modules enabled in Magisk?
[Magisk] amw2320:
It should work with only Dreamer's module. If it is detecting root, then it is doing it some other way.

Remember this is only hiding

Magisk

. It does not hide the fact that you are using a custom rom. I would try this again with the S8 stock rom to see if there is something else that the Ambasadii rom has done to trigger detection. I assume Microsoft is smart enough to know that if you have a custom rom installed, you are probably rooted.
[Magisk] grilledbacon32:
Hey amw, I see that John released a huge update to Magisk today, do you know if he included the fix you submitted this time?

Thanks!
[Magisk] Didgeridoohan:
Not quite the same, but it's there:

https://github.com/topjohnwu/Magisk/commit/88fae36b8a8d34f0643fbefa243c1da93282f1ea
[Magisk] amw2320:
He did implement the feature, but he did it in a different way. I don't quite understand the implementation, but am about to test it out to see if it works.
[Magisk] grilledbacon32:
Thanks for the reply guys! Please let us know how the testing goes. I'm not home right now or I'd test as well.
[Magisk] amw2320:
Seems to be doing the trick!

04-29 11:04:25.512 885 1415 I ActivityManager: Start proc 8894:com.microsoft.windowsintune.companyportal:auth/u0a128 for service com.microsoft.windowsintune.companyportal/com.microsoft.workaccount.authenticatorservice.AuthenticatorService
04-29 11:04:25.515 622 645 I Magisk : proc_monitor: com.microsoft.windowsintune.companyportal:auth (PID=8894 ns=mnt:[4026534392])
04-29 11:04:25.522 8900 8900 D Magisk : hide_daemon: start unmount for pid=[8894]
04-29 11:04:25.522 8900 8900 D Magisk : hide_utils: Cleaning magisk props
04-29 11:04:25.529 8900 8900 D Magisk : hide_daemon: Unmounted (/sbin)

Edit: I finally figured out how its working. It requires a bit more code, but gives the benefit of logging the full process name unlike the earlier patch.

For those interested:

During the scanning of process names, the code looks for a colon. If found, the location of that colon within the processName string is saved and replaced with a "\0" character. This character marks the end of the string, so when the processName is compared to the hidelist it will see a match as the subprocess name is ignored. Once matched, the "\0" character is replaced again with the colon so the processName shows up properly in the log.
[Magisk] paarnoutse:
*** Warning ***

Although Magisk v16.4 (beta) seems to be able to hide Intune incl. subprocesses now, upgrading to Magisk v16.4 (beta) may cause problems at some devices cq. Android versions.

Eg. at my device (OnePlus 5 running 8.1 [Oxygen 5.1.1]), I upgraded Magisk from v16.0 (stable) to v16.4 (beta), but after reboot Magisk Manager showed 'Magisk not installed', so my device was not rooted anymore at all after this upgrade!

To get rooted again I had to revert to previous Magisk version, and therefore also to re-install Dreamer(3MF)'s "IntuneHider4Magisk" module to hide Intune subprocesses.
[Magisk] xstrike9999:
Hey everyone,

Is there a way to remove Intune as a device administrator but still keep your device enrolled?
[Magisk] Dunedine:
Hi all,

I am trying to get Intune to enroll my device (S9+) but it doesn't seem to be working. I am running a custom ROM (Renovate Ice r67) with magisk 16.4(1642)-jenslody.

When i try to enroll, i goes all the way to "Finishing Setting Up Device" but then fails. It doesn't say that root or USB debugging has been detected. Just says this device needs to update device setting and that compliance state is unknown. I have a small suspicion that this could be due to Knox being removed from the ROM since during the enrollment process I have to "Confirm Knox privacy notice".

Has anyone else experienced something like this on Samsung devices (also used to happen on my note 5) and is there a fix for this?
[Magisk] nadeem_naddy:
All those who wanted it to work on magisk installed rooted device, just take the telephone permission away from google play services app and hide the company portal app in mgisk hide and try to register yourself.. it worked for me..
[Magisk] ram4ufriends:
Are you using magisk 16.4?
[Magisk] Dreamer(3MF):
Did You Try The Module Of IntuneHider4Magisk?

---------- Post added at 11:12 PM ---------- Previous post was at 11:12 PM ----------

Did You Try The Module Of IntuneHider4Magisk?
[Magisk] mdonders:
Is there any way then to "hide" the fact I'm using a (not-rooted) custom rom? So the company portal doesn't detect it?

Thanks Mark
[Magisk] nadeem_naddy:
Yes
[Magisk] docentore:
I'm temporarily using my old Meizu MX4, which was rooted at some stage (root was gone after update, and I'm having issues with rooting it again).

Intune Company Portal would not allow me to use my company's email, saying the phone is rooted (it isn't atm).

But I still had SuperSu and BusyBox apps installed, uninstalling them 2 allowed me to user the email (I'd say it was SuperSu only).
[Magisk] rajackar:
I'm looking in to this as well. Sadly I haven't been able to figure this out yet. Did you have any luck?
[Magisk] illwafer:
i'm pretty sure you could freeze the app with titanium backup. however, other apps that depend on it will probably stop working.
[Magisk] rajackar:
Do you mean freeze it after enrollment and before removing the device admin from phone settings? Email and other apps only check if the device ID is correct with the enrolled device. They don't use the local app as far as I know.
[Magisk] illwafer:
ah sorry. i misinterpreted your question. i'm not sure how to remove something from phone administrators ONLY.
[Magisk] paarnoutse:
After removing the Device Administrator rights for Intune Company Portal, it continued to work OK for me.

HOWEVER, as a big surprise, after a couple of weeks the device enrollment was removed (device disabled in my registered devices), and a message was shown that this was done because my device was rooted!

Because this happened around the time that I had to change the password for my company account (required every 3 months at my company), I guess that when you're also updating that password at your mobile, this action ALSO triggers Intune to re-check other requirements (like - for our company - min. 6 digit device PIN). During that checks Intune will discover that it doesn't have Device Administrator rights anymore, and because such a disabling is ONLY possible at rooted devices, it disables your device.

My (preliminary) conclusion / tip at the moment:

Removing Device Administrator rights for Intune seems to be possible, but make sure to re-enable it *before* a password change for your account is required.
[Magisk] Ratheesh6:
Working perfectly, thanks for the build.
[Magisk] ram4ufriends:
My Company has restriction to not use Android 9.0 Beta, is there anyway we can over come that?
[Magisk] Dreamer(3MF):
In-Case Of Using A Beta Version Of Android P Which Doesnot Support Until Now Some Classes/Functions Which In This Case Returns A Fault. And Due To Intune App Doesnot Cover Also The Changes Of Android P, It'll Refer This Fault To One Meaning Only That The Current Android Version Is Below 4.4 (Kitkat). I Expect Intune App To Be Updated Within The Next Months To Support The New Android Version (Android P).
[Magisk] ram4ufriends:
Intune does work on Android P Beta...it's been Working fine for me for last 2 months..just a week ago my organization has enforced a Intune rule to not allow Android P Beta..
[Magisk] Dreamer(3MF):
What Is The Message Which Will Be Shown In-Case Of Using Intune On Android P Beta?
[Magisk] ram4ufriends:
Here you go
[Magisk] Dreamer(3MF):
I Can Make A Special Version Of DeviceSpoofingTool4Magisk To Suit Your Case But I Don't Know If That Will Work Or Not So If You Want To Try, Inform Me.
[Magisk] ram4ufriends:
I am in...is that spoofing only for Intune or across the OS? I would prefer that spoofing to be only for Intune if possible
[Magisk] Dreamer(3MF):
Kindly Send A Copy Of Build.Prop OF Your Device For Android 7.1.2 & Android 9.0
[Magisk] ram4ufriends:
Hmm..I don't have one for 7.1.2..but attached is for 9.0
[Magisk] Dreamer(3MF):
After Checking The Sent File & Updating The Module, I Will Send Another Post With Instructions.
[Magisk] Dreamer(3MF):
Kindly Check This Post https://xdaforums.com/apps/magisk/module-microsoft-intune-company-portal-t3780451/post77117804
[Magisk] ram4ufriends:
Didn't work..still the error ...just curious...why does WiFi and data should be disabled?
[Magisk] Pokemon Trainer:
Solution here

https://xdaforums.com/apps/magisk/module-microsoft-intune-company-portal-t3780451
[Magisk] nadeem_naddy:
Did anybody find a way to bypass encryption check? I dont wanna use xposed though, if there any magisk module to hide encryption status.
[Magisk] Didgeridoohan:
You could try changing the prop ro.crypto.state to encrypted. You could use MagiskHide Props Config and set a custom prop, or simply place a boot script in /sbin/.core/img/.core/service.d (or post-fs-data.d, test both and see which one works) with this:

resetprop ro.crypto.state encrypted

There are also other crypto props (ro.crypto.type, etc), but this one feels like it might be the one the app looks for.

HUGE DISCLAIMER! I have no idea what changing this prop will do to your system. Proceed at your own risk...

Edit: note that you'll also have to give the boot script execution permissions (chmod 755) or it won't run during boot.
[Magisk] subarctic2123:
I got an update on intune yesterday. When the app was started I could start it and all applications was grayed out. When I restarted it a second time it stated thay my phone was rooted. So they have developed a new way to detect root. All safetynet and rootcheckers passes without problem.

I have hidden all microsoft apps and everything stated above. intunehider magisk module installed using magisk 16.7. All have worked until yesterday.
[Magisk] subarctic2123:
Yes, this is a new way of detecting root.
[Magisk] casouzaj:
But has it sorted your problems out or not? It did in my case. Side effect is that the Safetynet tests cannot be performed by Magisk Manager whilst hidden. You have to rely on a second app for that purpose.
[Magisk] subarctic2123:
No, its not sorterd out. I think you havent got the latest update of the app yet and its a staged rollout.

This is a new version 5.0.4140.0.
[Magisk] casouzaj:
Yes, that's the version I'm using, as well! Then it could be related to the device and/or ROM in use. Mine is a Sony Xperia Z3 Compact phone, running CarbonROM 6.1.
[Magisk] casouzaj:
Doubled post! XDA Labs issue!
[Magisk] subarctic2123:
No, you are using 5.0.4104.0 and not 5.0.4140.0, mine is newer.
[Magisk] casouzaj:
Oops, I misread it. Sorry!
[Magisk] os2baba:
This may well be a problem with Intune. I'm on a never rooted stock Pixel 2 XL, but on Pie. And it's saying that the phone is rooted. But I'm on 5.0.4104.0. So it may be an Android 9 problem for Intune.
[Magisk] subarctic2123:
I´m on 5.0.4140.0 with Oneplus 5T with OOS 5.1.4 (Android Oreo 8.1). I haven´t had any problems before 5.0.4140.0 which came out august the 7th.
[Magisk] casouzaj:
Udated Microsoft Intune Company Portal app working again!

OK, my Intune Company Portal app has just been updated to version 5.0.4140.0, and, just like yours, it has started accusing that my phone was rooted. After some investigations, I have found out how to solve it. Here it is:

Through either a terminal emulator app, or an adb shell command in a command window on your PC (with your phone connected to it, of course), enter these commands:

su
magiskhide --add com.microsoft.windowsintune.companyportal.omadm_client_process

Hope it works for you, as well!
[Magisk] _litz:
Worked here
[Magisk] casouzaj:
Thank you for the feedback!
[Magisk] Oakley707:
Worked like a champ, you are a lifesaver.
[Magisk] bedroidapp:
Works here too. Magisk manager hide is not enough anymore. Need that command and no need to restart.

Thanks!
[Magisk] praveen12bnitt:
Works for me too. Thanks!
[Magisk] Dreamer(3MF):
For Hiding The Root From Microsoft Intune Company Portal, Check This Thread https://xdaforums.com/apps/magisk/module-microsoft-intune-company-portal-t3780451.
[Magisk] shashank094:
Works on the latest 17.1 version as well. Thanks a lot!!!
[Magisk] Hans Dingemans:
Thank you, this works fine!
[Magisk] avatar1961:
Tasker Run Shell

Is there any kind of docs on how to set this type of thing up in Tasker?
[Magisk] Psyki:
Worked for me with intune 5.0.4176.0! And I mean instantly. For me the issue was with Microsoft Remote Desktop Client but I pasted the line in a terminal window, hit enter, immediately opened it up and **** yeah! Worked like a charm. Thank you very much!
[Magisk] casouzaj:
Thanks for your feedback! I hadn't even noticed that my Intune Portal had been updated to the 5.0.4176.0 version as well, as it kept working without having to touch the magiskhide list again.
[Magisk] Psyki:
In retrospect I had already hidden company portal in the magisk UI but it stopped at com.microsoft.windowsintune.companyportal. There should be a way in the UI to add your own apps to block/hide, or to have it automatically hide children of the apps. I'm not sure exactly what 'omadm_client_process' is or does but it seems like hiding the parent should have been enough.
[Magisk] Stallio:
Nooby Assistance

Hi don't get me wrong but I have installed the emulator app but whatever I type, copy or paste it says

Not found..... Please guide a bit how to type the command in terminal emulator so that I can make In tune to not detect root
[Magisk] paarnoutse:
Instead of issuing all required 'magiskhide' commands for correctly and sufficiently hiding the Microsoft Intune Company Portal related entries using a terminal emulator, I would highly recommend to just install the great Magisk module "IntuneHider4Magisk" by [MENTION=9018566]Dreamer(3MF)[/MENTION].

See https://xdaforums.com/apps/magisk/module-microsoft-intune-company-portal-t3780451

Just download and install the correct version of that module (depending on your Magisk version), reboot, and all should be OK.
[Magisk] Stallio:
Thanks a ton it worked!!
[Magisk] casouzaj:
My Intune Portal has also been updated (probably days ago) to version 5.0.4206.0. Everything was fine, until this very moment. I'm running the latest Magisk Canary version, which was updated today. Don't know whether it as due to it or not, but it started accusing my device was rooted. After a new analysis over a logcat command, I added the following entry to the Magisk Hide list, and my Intune Portal was back to service:

su
magiskhide --add com.microsoft.omadm.origindetection.DeviceOriginContentProvider

Just my other 2 cents...
[Magisk] paarnoutse:
The penalty for not having installed the Microsoft Intune Company Portal Hider module, which already included the described entry :good:

Just my other 2 dollars... :laugh:
[Magisk] casouzaj:
Yes, I'm aware of it. I just posted the information I found out from having analysed the logcat outputs after having faced a real issue . I don't run that module due to a couple of reasons:

1 - I manually added 5 entries only to the Magisk Hide list to cover my current needs regarding Intune, whereas that module would add dozens of entries.

2 - That module thread states that it covers up to Magisk v17.3 (stable builds). I run the Canary latest build, which is currently in v17.4.

Peace!
[Magisk] Dugeti:
Awesome job ! Works perfectly!
[Magisk] virags:
Thanks for making this , I am however having a problem , my outlook configures and i can see my emails for the first time , then if i close the app and I start it again , outlook gives a popup saying the device is rooted and wont let me see my emails again. any help is appericated.

Device : SM-G965/DS

Magisk : v17.4-018c0064

Safety net pass : True

Intune Company Portal : 5.4.4206.0
[Magisk] casouzaj:
Do you pass both Safetynet tests? Is Magisk Manager itself hidden in its settings?
[Magisk] virags:
thanks for the response, yes both safety nets are passed and Magisk Hide is enabled in the settings.
[Magisk] casouzaj:
Which Intune Portal version is installed?
[Magisk] virags:
Device : SM-G965/DS

Magisk : v17.4-018c0064

Safety net pass : True

Intune Company Portal : 5.4.4206.0
[Magisk] casouzaj:
My phone is a Sony Xperia Z3 Compact, running CarbonROM 6.1. My Magisk Canary is, apparently, newer than yours. Take a look at the attached screenshot. Update yours, to see of it changes something.