yashsingh1/xdaforums huggingface dataset:
[Magisk] candiesdoodle:
No man.

All it is detecting is the presence of the su binary in /sbin

Once you change the permission of sbin to 754 or 750 .. it works fine.
[Magisk] kqueenc:
I wish it would be that simple.

Does not matter what permission I give to the folder (I even changed it to 400), Intune still gives the same result: You device is rooted!
[Magisk] candiesdoodle:
I think it also depends on what type of policy is pushed.

I dont need to configure intune company portal .. just have it installed on my phone. yes strange, but thats the case. if i dont have it installed, outlook forces me to install it.

So i suppose root checking is little 'relaxed' with this setup.

Have you tried xposed for N yet? i suggest you give it a shot and try this module

http://repo.xposed.info/module/com.hugesoft.sbpforcp
[Magisk] girtsn:
Thanks for the idea, I used tasker to trigger a similar shell script (/sbin instead) when Outlook app is launched, seems to work without issues - have to enable the trigger by app in accessibility options though. Also for anyone having issues with changing permissions on /sbin, root filesystem must be remounted to rw "mount -wo remount rootfs /"

working on v13.3 here - strange thing if enabling hide from magisk, outlook app crashes on start
[Magisk] illwafer:
[MENTION=246790]girtsn[/MENTION] nice! Do you mind sharing your Tasker script and clarify the accessibility part?

Thanks for your help.
[Magisk] candiesdoodle:
Try this. It's an XML so u need to import into Tasker.

App creation is not working for me.. will figure out.
[Magisk] pyrochance:
I also found that i didnt have to log into Intune, just needed it installed as described above.

after some troubleshooting, installing/uninstalling intune i noticed Outlook would temporarily work until it checked for Intune again.

From there i found a work around by simply freezing intune with titanium backup.

This seems to suffice Outlook as it sees intune is "installed". I've restarted my phone and force closed the app a couple times and it still works.
[Magisk] illwafer:
The above didn't work for me. When I launched Outlook it asked me to enter my Office365 password which never works. After I defrosted it worked again, and I didn't have to enter a password.

I would think freezing/disabling Intune (company portal) is the same as uninstalling...
[Magisk] pyrochance:
Did you install the outlook as admin or intune as admin?

i did the outlook admin since its less restrictive on my system than intunes admin restrictions.. (seems bizare to me that its like that...) may be related to your companies policies being set.

disabling leaves the application still there but turned off so to speak. so when another app looks to see if its installed. it technically is still installed.
[Magisk] illwafer:
Outlook Device Policy is a phone administrator, but Company Portal is not. Maybe we have differing Outlook policies.
[Magisk] pyrochance:
well, my assumed victory was a short one. After about an hour or so of it working consistently. the work around no longer works. i keep getting prompted to re-enable intune.

And my aforementioned troubleshooting that gave me the idea does not work either. it required intune immediately after uninstall now. So i guess it was a fluke? idk.
[Magisk] candiesdoodle:
Can some one try the universal safety net fix.. (latest test build) available on the magisk forum.

I think it works.

Enable the module; then Just add the outlook/ intune apps to magisk hide and disable magisk hide from within magisk manager.
[Magisk] kqueenc:
Will you please give a specific link. I'm a bit afraid to get a wrong one.
[Magisk] candiesdoodle:
https://xdaforums.com/apps/magisk/xiaomi-safetynet-fix-t3600431/page103

One available here..V2 beta 5 test 7

U will need to join their telegram group.
[Magisk] kqueenc:
Thanks for the hint.

This fix works almost fully as I expect.

After installation, it can pass safetyNet test in Magisk manager (MagiskHide turned off).

It also passes Google Play Store, so I can see Netflix again in it.

BUT, I still CAN NOT pass Intune's compliance check!!! How the hell does it manage to do that???:eek:
[Magisk] candiesdoodle:
Haha

Try restarting etc. Magiskhide and usnf module don't seem to go well together

Try disabling magiskhide and then making sure the package names are added to the hidelist. If you add packages from within magisk the magisk hide gets enabled.

/magisk/.core/hidelist

com.google.android.gms.unstable com.microsoft.windowsintune.companyportal

com.microsoft.office.outlook

com.conc.....

Also make sure the permission of the file is 644

Then do a restart and check again

I had a issue with that last app .. but then it worked.
[Magisk] kqueenc:
Guess what. No change!

I even used usnf tool to force fingerprint and universal sure hide to be 1.

And , I changed the values of some sensitive prop as thread suggests.

Still no go.

I'm using LingoOS based RR remix. As thread implies, this OS sometimes is much easier to be considered as a tampered system. Maybe that's the reason.

I think I will give up.
[Magisk] candiesdoodle:
Oh man. That's sad. I don't have any more suggestions unfortunately.

Though it's working perfect here. Maybe the diff is the way it is setup.. (I don't need to configure intune, just have it installed).
[Magisk] kqueenc:
That is the difference. My company force us to grant intune device administrator before we can finish the installation.

And I think that gives Intune more power to check more points than it can do in non-admin mode.

Actually, it does not give any difference if I install it or not.

But it really pisses me off that Intune's compliance check seems to be the only root check I cannot pass so far.:D
[Magisk] tL.Lando:
I totally understand, I am in the same situation as well. My company requires full administrative rights. I am stuck using the company supplied iPhone :eek: Unless I run stock Android of course, but that's no fun.
[Magisk] illwafer:
You might want to give the new suhide a go. Link:

https://xdaforums.com/apps/supersu/suhide-lite-t3653855
[Magisk] amw2320:
Like candiesdoodle, mine works great if I change permissions on sbin (I'm running stock). However it is only lasting for a couple days before Intune seems to run in the background and disable. Anyone have a decent idea on how to intercept it? I tried setting Tasker to hide it for 5 min when the app is run, but it seems like Tasker doesn't pick up the background app.

Edit... actually the Intune app is still saying I am compliant. I just got blocked by the organization? Needs more digging.

Edit 2... Yep, definitely running in backgrounds and I'm losing my compliance.
[Magisk] wdwms:
Has anyone looked at the code for the xposed module "Security Bypass for Company Portal"? I think its out of date, but it may give some hints to what intune/company portal is doing..

http://repo.xposed.info/module/com.hugesoft.sbpforcp
[Magisk] illwafer:
yeah. it didn't work for me when i tried it about 6 months ago.
[Magisk] amw2320:
Just installed suhide-lite. After hiding the suhide and superuser apps from the system (vol up/down x3), I'm passing the compliance check. I'll update in a few days if it gets caught in the background like Magisk.
[Magisk] KRiST0F:
Did you manage tot keep magisk aswel? I failed, no supersu binaries. :(
[Magisk] amw2320:
No, i had to uninstall magisk first. I'm on a Pixel, so I can't use modules anyway. The only difference on this device is each apps hiding ability.
[Magisk] amw2320:
Going on 48 hrs now... It looks like suhide-lite keeps InTune compliant with one exception -- as soon as you unhide the root app (which you need to do to open it), you immediately lose compliance. Intune must be triggering a scan when any app is added, then sees SuperSU and revokes compliance.

Somewhat annoying, but apps already given root access will still run, so its not that often that I need to access the SuperSU app itself. This is definitely better than manually reissuing compliance daily which I was having to do with Magisk.
[Magisk] KRiST0F:
i'm not able to fix it. probably stick to magisk and hope v14 comes up with something new.

This because all my apps crash after installing supersu and suhide lite
[Magisk] btongminh:
Great suggestion, suhide-lite works for me as well
[Magisk] wdwms:
I can confirm suhide-lite works here as well. I'm running an HTC 10 with Viper Rom, and I've got Magisk with SuperSu installed..

Now if I could get Intune to ignore that i don't have a password set! :)
[Magisk] Wortelstok:
Do you have Magisk & Suhide-lite both installed? Or Magisk & supersu both? Isn't that overkill? I can't install suhide with Magisk.
[Magisk] mandarpalshikar:
Hi Buddy... were you able to work this out? am using Magisk on my OP3T and unable to pass device compliance in MS Company portal. So trying to check ways to have this work. SU Hide lite is not getting installed ontop of magisk since it need sbin linked su.

Tried with xposed installed in magisk and an xposed module RootCloak to hide root from company portal and that didnt work too.

Is there a way to have SuperSU installed on my device which already has magisk installed? And if yes, then will using su hide lite with super su solve the situation ?

---------- Post added at 04:44 PM ---------- Previous post was at 04:42 PM ----------

Hey mate, am using Magisk on OP3T beta ROM 15. Can you please help me find way to install SuperSU on top of Magisk ?
[Magisk] wdwms:
I just reinstalled viper rom which i use. It comes with Magisk/SuperSU option.. so i used that, then installed Suhide lite... done..
[Magisk] kpmohamedhussain:
Only work around for now is to freeze intune with TB..
[Magisk] Bradden1:
Could you explain what you mean? How does hiding intune help?
[Magisk] kpmohamedhussain:
Sign in to intune... Access outlook once, it will say you are rooted.. just ignore...

Now freeze intune in Titanium Backup... Access emails in ur outlook without any hassles...
[Magisk] nv0728:
I created a Tasker Task to launch Outlook.

1. Secure settings: Enable: Company Portal

2. Wait 5 seconds

3. Launch App : Company Portal

4. Wait 25 secs. (Company portal should launch and connect to the internet)

5. Secure settings: Disable: Company Portal

6. Launch App: Outlook

Seems to work for the moment.

I added a shortcut for the task.

Not very convenient, but each time I need to check Outlook, I run the task.

Do let me know if this worked for you. Suggest improvements.
[Magisk] Bradden1:
Thanks for the post.. Hoping someone can figure this out.
[Magisk] aPexalpha:
I just got here from Google and I've got the same problems. Can't get my e-mail on my phone now. Meh
[Magisk] Bradden1:
Delighted to say that the latest version of Magisk allows you to pass all company portal checks and register your device..
[Magisk] kpmohamedhussain:
How???? Doesn't work me... On magisk 14.5
[Magisk] Bradden1:
Odd. Have you updated magisk manager?.. Then set it to hide from company portal.

I then used magisk to rename the manager to a random package under settings.

After doing this it passed all intune checks.. I know our IT dept haven't changed anything as we had a challenge to see if I could get past it with my rooted phone.. I work for a small friendly company. :)
[Magisk] ScottIsMyName:
I couldn't get it to work using this method, has anyone else had any luck?
[Magisk] candiesdoodle:
This is indeed the case. If you rename /sbin/su to anything else, intune and outlook don't see the root.

I have created a Tasker to invoke

/root/magisk su -c "mv /sbin/su /sbin/mu"

Everytime I want to hide root (from everything not just intune)

And then reinvoke

/root/magisk su -c "mv /sbin/mu /sbin/su"

When I want root

Is there a way to hide a file (/sbin/su) from other programs based on user id or mountspace?
[Magisk] ScottIsMyName:
Theoretically this is what magisk hide should be doing, and sbin should be unmounted, but somehow that's not working. How do you invoke your tasker scripts? Manually?
[Magisk] candiesdoodle:
Yup manually. Have a widget on the home screen to trigger the scripts

Usnf module used to successfully hide root from intune. But it doesn't work with v14.5
[Magisk] ScottIsMyName:
Well I got it to work so that when I open Outlook, it automatically runs the unroot action.

I also made it so that if you exit outlook, it runs the root action again. But since Outlook usually doesn't "exit", I made a widget for the home screen to unroot as well. So far so good.
[Magisk] Oakley707:
Tasker n00b here, but would you mind stepping thru what exactly you are doing? I'm guessing the action is "Code Action" then Run Shell? Intune was just pushed from Corporate and I'm in a jam...

UPDATE: This couldn't have been easier. Just did the above and it worked like a champ! Thanks again!
[Magisk] liquor:
Also tasker n00b here...can you elaborate on how to set the above script?

I've renamed su with root file explorer and confirm Intune check works but I don't think it's the good way to do it...

Thx
[Magisk] candiesdoodle:
Use this XML to import the tasks. Then create widgets to call these tasks

Ofcourse it's not the right way to do it. You are essentially denying root to any app that may require it. But then you can restore it back whenever you want to use use root.

Remember that with Magisk, the actual root (su) binary is /root/magisk itself ... And /sbin/su is only a link to that main binary.
[Magisk] liquor:
Thanks - but my /root folder seemed to be empty (root explorer - show hidden file). Is it normal?

Using Magisk 14.0
[Magisk] candiesdoodle:
Use 14.5
[Magisk] liquor:
Stayed with 14.0 but modified your tasks (/sbin/magisk instead of /root/magisk). Works pretty well thanks for your help!
[Magisk] vipercross:
Hey, I'm using magisk 14 but what is the exact procedure to do hide my root?

I downloaded tasker
[Magisk] candiesdoodle:
Can any one try with latest 14.6 magisk and tell whether intune+outlook is working or not
[Magisk] fixxxer0:
Not working for me, but I upgraded from inside the 14.5 / 5.3.5 app

So who knows, I could have some remnants files/folders it's detecting. It still detects the root folder. If I rename that it works. I do have the new magisk in adb folder like it's supposed to be, but can't have root working when I rename the root folder.

I think a clean install with first time root using 14.6 will confirm one way or the other
[Magisk] ScottIsMyName:
I fully uninstalled magisk using the official uninstaller (dated 12-29), and then reinstalled 15.1. Unfortunately, In Tune still detects root.

I don't think much has changed in how it's detecting root.....it's basically just searching for the su binary in the $PATH variable.

My tasker work around still works, it's just kind of a nuisance. Hoping maybe [MENTION=4470081]topjohnwu[/MENTION] is able to look into this once things settle down.
[Magisk] emajnthis:
My magisk install wouldn't allow me to change permissions on the magisk folder, but I ran the same Tasker on the sbin folder instead and it passed intune.
[Magisk] lucky3335:
I'm using resurrection remix rom nougat with magisk 15.1, can anyone please let me know step by step process for accessing outlook using Tasker method... The whole thread is confusing...
[Magisk] bspec:
I have to give a huge thanks to candiesdoodle for providing the tasks to allow me to keep my Nexus 6 after my company implemented intune. This phone was worthless on the stock room. I'm not doing anything malicious. I just want to be able to run a custom room and make my phone usable.

I'm running Magisk 15.2 on 7.1.2, and the tasks weren't fully working on my phone. The ls commands we're erroring out. I made some updates in the attached zip.

Also, as mu reverts to su on boot, I created a profile to run the Check Su task on monitor start. I had originally tried running the Hide Su task at start, but that seemed to cause issues with Magisk, often acting like it wasn't installed.
[Magisk] candiesdoodle:
Super!! Thanks for sharing
[Magisk] candiesdoodle:
Now that xposed for Oreo is released.. Any one know if a way to hide xposed and root...?
[Magisk] bspec:
It looks like I didn't fully fix the unhide task, and it was still erroring out. I fixed that I the attached file and added a new task that gives the option to force stop Magisk Manager when you unhide root.

I normally run my phone with root hidden as I don't use it all the time. I then use the Tasker widget to unhide it when I need it. However, Magisk thinks it isn't fully installed when this root hide method is used. This is problematic when Magisk finds an available update, auto update doesn't work. Since the fact that Magisk has found an update is enough to keep it alive but it needs to start with root enabled or there are errors, I end up force stopping it after enabling root and then restarting it in order to update. The new unhide task makes this easier by giving an Action to force stop Magisk.
[Magisk] MTK6589:
+1 ,anyone find solution?
[Magisk] Didgeridoohan:
It is very unlikely that there'll be a solution for hiding Xposed. There may be other solutions, but they'll most likely involve deactivating Xposed in some way.
[Magisk] lowrider82:
Hi man, i have a galaxy s7 edge with customer rom and also facing the same problem. I downloaded tasker to try this work around and be able to use Microsoft apps (yammer, skype) that have intune portal. I'm not familiar with how to implement your fix.. Could you help me step by step on how to add these tasks?
[Magisk] bspec:
It shouldn't be too difficult, but my understanding is that Samsung devices don't always play nice. See the attached updated zip in this post.

[Install Tasker] Install Tasker on your phone from the play store (I believe I paid for this using my Google Opinion Rewards app $).

[Obtain tasks] Download and extract the tasks2.zip your favorite app (I used 7zip on my PC and then copied to my phone).

[Obtain tasks] Copy each of the 4 extracted files (Check_Su.tsk.xml, Hide_Su.tsk.xml, Close_Magisk.tsk.xml, and Unhide_Su.tsk.xml) to a folder on your phone.

[Import tasks] In Tasker, long press the Tasks tab and select Import. Navigate to the folder you saved the tasks and import each one.

[Test tasks] In the Tasks tab in Tasker, open each task and step through (play button with line to the right) each one to verify they work.

[Set up Monitor Start Profile] On the Profiles tab in Tasker, click the + to create a new profile.

[Set up Monitor Start Profile] Select Event and search in the Filter field for Monitor Start. Select Monitor Start and then click the back arrow at the top of Tasker. Select Check Su.

[Set up Widgets] Long press on a blank space on your home page and select Widgets. Scroll to Tasker and long press on the Task 1 x 1 Widget. Place it on a free space on your desktop. Select your desired task (I did one each for Check Su, Hide Su, and Unhide Su). Tasker will bring you to a screen to edit the widget, and it isn't clear what to do next. Tap the back arrow at the top of Tasker, and it will create the widget.

That should get you going. Let me know if it doesn't work.
[Magisk] lowrider82:
Hi mate firstly massive thanks for spending the time to help. Super grateful. I did what you said and created the widgets. Unfortunately close magisk and hide su give error red light when I test them.. First one on first step and second one on third step... Anything I should change?
[Magisk] bspec:
Have you granted Tasker root privileges through Magisk? What version of Magisk are you on? I'm on 15.3. I think one of the earlier posts says that if you are on version 14, you need to run /sbin/magisk instead of /root/magisk. Can you use something like Terminal Emulator (with root privileges) to validate the path to magisk?

For close magisk, make sure you have the correct package name.
[Magisk] lowrider82:
Man you are the best! It's working! It was missing superuser rights. Now one last question. Is there any way with tasker to make it so that it automatically hides everything when I launch the business app... And re-enable root after a while or as soon as I kill it?
[Magisk] bspec:
Alas, that is beyond this beginner's skill in Tasker. This work with Magisk is the only thing I've gotten to work. I attempted to create a task that would automatically disable the night light on my Nexus 6 when I opened Netflix so that I could actually watch videos at night and not just get a black screen with audio and failed miserably.

To run an action when an app starts, you have to set up a profile that looks for that app to start, and then tell that profile to run a task, such as unhide. If you get it working, please post here.
[Magisk] candiesdoodle:
Yes it's possible. You will need to create a seperate shortcut for a new task. The new task should basically first 'hide', delay by say 2 seconds, then launch Outlook and then delay again by say 10 seconds, and finally unhide.

I have done this in the past but it's shaky .. I got pushed off intune once. I think root will be detected in background and reported as non compliant. If this keeps happening access will probably get disabled.
[Magisk] jahouse:
Thanks bspec! This works great on my oneplus 5T. I'll let you and others know if I run into any problems over time.
[Magisk] candiesdoodle:
Ok Can anyone try the latest 15.4 and see if intune is detecting the su binary or not

The magisk changelog mentions hiding binary names
[Magisk] AshKaiser:
Unfortunately, no.

Im running 15.4 but intune still manages to detect root. Guess we need to stress this more.

But im currently running a tasker profile which enables and disables root, whenever i open/close intune/skype/outlook using the rename command and its working seamlessly. I get a toast. that is all the difference it makes though.

Eidt: yup, there's still an inconivience. Intune chucks out when left unattended. Which deletes all the mails from my Outlook. I had to login to intune again, prove that my device is clean, then open outlook again, add my email again, sync all my emails again. Pain indeed.
[Magisk] ScottIsMyName:
The rename command doesn't seem to work on 15.4 for me.. Anyone else? I noticed the binaries in the too folder were renamed so I changed my tasker script accordingly, but still not working
[Magisk] ScottIsMyName:
I figured out the problem. With 15.4, the binary names were changed....my previous tasker script was running /root/magisk. That has been renamed to a random name, and you can no longer run /root/ia32fmlwl and have it execute (the program checks to see if the program name is magisk, else it throws an error). I modified my tasker script to run /sbin/magisk and it works as expected.

By the way, there is a pull request that attempts to unlink /sbin/su during magisk hide operations. I tried it out and it works, the only problem is that it doesn't restore it when unhiding. My few attempts at modifying it to restore it have failed so far, but this is promising, and should eventually work so that we don't need tasker at all.

https://github.com/topjohnwu/Magisk/pull/374
[Magisk] grilledbacon32:
Anyone try with the new 16.0 update??
[Magisk] mitzager:
Unfortunately it doesn't work.
[Magisk] MTK6589:
If anyone found solution how to run Outlook / Skype / Onedrive with latest Magisk ... please let us know.

Thank :(
[Magisk] gopi159:
Am too eagerly looking for a way to have outlook work on the rooted phone
[Magisk] devil-kin:
Interesting. I'll have a go at it tonight to see if I can "fix" that restore. Code seems simple enough ;)
[Magisk] ScottIsMyName:
It's weird, I thought I had the correct code to do it too, but i kept getting crashes in MagiskManager after I installed it. Steps I took:

1) In include/magisk.h I made a new extern char [PATH_MAX] to save the magisk binary name.

2) In core/daemon.c where "magisk_name" is used, I saved buf to magisk_name after the path is appended to buf.

3) In magiskhide/proc_monitor.c I unlinked /sbin/su when other things are unlinked. I symlinked /sbin/su from magisk_name where other things are symlinked.

Upon boot, it seemed to work properly, but apps didn't get root access even though I could see /sbin/su was linked appropriately. And like I said, MagiskManager kept crashing.

I was going to test a full uninstall/reinstall to see if that would fix it, but ran out of time.

Let me know if you have any luck!