yashsingh1/xdaforums huggingface dataset:
[Magisk] skuppej:
For me, Teams v1416 (or older) works with CP 5.0.5147.0. Any newer version of Teams will require a newer version of CP which will detect root (no fix, as of today). Also, I don't use the work profile that CP makes, so I can't comment on this if that is your issue.

Yes, you still need to enable MagiskHide on Teams & CP for this to work. If these apps are not showing up then you have a broken Magisk installation.
[Magisk] c19932:
Is there any way to bypass the lockscreen and adb requirement in company portal? My organization requires a password and adb disabled. Thanks in advance!
[Magisk] that_bad_monster:
Hello Everyone,

Hope you are well. I work for said company who produces Intune and Defender. A moment ago, I successfully bypassed Intune Company Portal. I full access to email, SharePoint sites, Teams, Outlook, Azure, Identity Protection, Defender, Service Hub, etc, all with Magisk Hide only. Apologies I cannot show my Email nor my Teams for verification, as I am a security engineer for said company.

****MAKE SURE TO HIDE ALL OF THE CHOICES I HAVE LISTED (IF YOU DONT USE IT, DONT DOWNLOAD IT)****

Make sure you do not open any of the initial app installs, and make sure all trades of your original attempts with Intune are wiped with Cache and Data.

MagiskHide (I named mine HideMe) all of the apps you are hiding. Even if you don't see the Company Installed apps after initially attempting the setup, the fact you have the apps installed and hidden PRIOR TO SETTING UP INTUNE, will insure that you get ALL paths.

All current with the latest Intune updated and Magisk on Stable Repo. Please pm if you have any questions. Happy to help, though I work off hours, but I will respond.

Please see the screenshots for verification. Cheers.

This is current as of 11/10/2021.

**Edit: This was done using a rooted OnePlus 7Pro 5G Sprint Rebranded to EU, running 10.14. with Magisk and TWRP Recovery installed***
[Magisk] Beatzekatze:
@that_bad_monster, thank you very much..... It works!!!! Great.... Now my Outlook Mail and Calender is working.....
[Magisk] amidsal:
I've tried this and it didn't work. My guess is that it won't work because I have EdXposed installed and it fails the safetynet.
[Magisk] that_bad_monster:
It will work. Both of those are separate instance processes of I/O. You would think they are connected but I'm fact are not. Intune doesn't care if your phone can can or can't pass safety net.

You have to delete BOTH INSTANCES of the apps... From the work profile AND the user profile BEFORE you attempt to hide Magisk. If you don't you are left with apps holding perseverance through prior data from the app.

Question:

WHY DOES THIS HAPPEN YOU MIGHT ASK?

Answer:

WHEN INTUNE IS INITIALLY OPENED, a portion of it's properties gets pushed by a security function it has baked into its coding, that makes the areas needing to be hidden from Magisk actually do the reverse that you are trying to do with Magisk... Intune's API connectors will shroud themselves from Magisk, because they are taught to look for it.

There is no way to patch this unless you write the code to initialize the shrouding function upon install. They can't because the app has to be opened and a onboarding process get kicked off for the shrouding to take place.

So delete the apps and when you FIRST reinstall the app... BEFORE ANYTHING. Go to the app properties and delete cache and data BUT DONT OPEN IT. Once the intiial install data and cache is deleted once, you are fine to proceed.

Also you have to think ahead for this workaround and download and hide EVERY WORK APP you are going to need. Otherwise if you try and add afterwards, Magisk Hide could slip and INTUNE regain partial control and all your apps will begin to stall and fail.

*EDIT* I also was using Edxposed and Riru.

*SideNote* if you are using Lucky Patcher, you need to be careful with how you install system apps or erase Dalvik Cache, you don't want to add too much to the Magisk to keep track of, since you can't push lucky patcher through modules on Magisk. The module that is used MUST be turned off if you are updating any firmware or altering with Magisk of any kind. You have been warned.
[Magisk] tomcat.x:
For me unfortunately it does not work, but seems to be special Samsung issue.

After my company started implementing Company Portal last week I found this thread. While fighting through it I collected some downloads. To learn in the end that I don't need it anymore - Magisk hide is enough meanwhile. (Which by the way is the case for nearly all of my apps, just for one banking app I have to disable Magisk Manager using tasker even if I hided / renamed the app.) On the other hand while reading and testing I got my SafetyNet check passing after months without. It was just by (re-?) installing current version of Universal SafetyNet Fix. Had no problems with other apps while not passing check but looks better.

My issue is that I'm getting some message saying I have a Customized OS. Was nearly about to ask here if that is same issue as for others. Nothing about "root" in the message. I also wanted to ask if there are other apps that remember my tries as I don't use Outlook. But then I found Insular (Island fork) which seemed to be a workaround, installed it and got same message. So message seems not to be from Company Portal app but from the OS itself (Google or Samsung).
[Magisk] __Michael__:
Same for me , looks like its triggered by the Knox.

It will be good to try stock ROM with root and see if its the same issue.
[Magisk] shouk_1987:
You are a badass security engineer dude

I am a networks project manager with voice background and i would give you a promotion if i can

I have only Teams plus Company Intune and i was scratching my head to make teams work after i changed the phone ROM as i need it daily for conference calls
[Magisk] c19932:
I have no problem hiding root from Intune, but is there any way to bypass the lockscreen requirement set by my company? My company requires a 6 character passcode which makes life miserable
[Magisk] sow07:
I followed the instructions above and was able to get it working with DenyList (Canary Magisk) on a Pixel 6 Pro. It's not so scary once the background of how it detects root is understood. Thank you bad monster for the insight! So for those a little unfamiliar with Magisk Hide or DenyList, checking the box for the MS app to hide is just the first step. You then have to select it to show all the sub processes which subsequently need to also be checked. Doing that for all the necessary apps (in my case it was Authenticator, Company Intune Portal, Outlook, and Teams) combined with ensuring they started clean (force stop/clear data) ultimately got the job done.

Very happy camper here!
[Magisk] jc-col:
Oneplus phone as well. I have selected all the work apps that have been installed in magisk hide. Magisk is also hidden.

Intune only shows up once the work profile is on. So to confirm, you enable work profile, then clear all the data/cache for intune and then run the setup?

I tried the above but still fails compliance saying that the device is rooted. any ideas?

Last time I did this on my old phone, I had to select a bunch of system files from com.qualcom... package, but I don't see any qualcom packages installed on the most recent version
[Magisk] superrama:
I was able to get outlook, teams and slack to work without the files in this thread.

1. I downloaded old version of Company portal v5.0.5147 from external sites

2. cleared storage and cache of outlook, teams and uninstall them

3. Install "magiskhide props config" module in magisk and rename your magisk app to something else (ex. hideme)

reboot

4. Magisk should now appear as new name you gave it. open it and go to magiskhide under SuperUser tab and select all the option for company portal and outlook/teams

reboot

5. open company portal and log in to register your device(it should pass)

6. open outlook/teams, they will likely complain that company portal is outdated. You can update company portal in google play store. no need to reopen company portal.

7. reopen outlook/teams and log in. you should pass.

Ive been using outlook,teams and slack on my rooted android 11 phone with magisk 23 all day
[Magisk] GohanBurner:
Wow...I must admit...I didn't think this was going to work. After failing so many times I gave up and just went and unrooted. But I tried this and it actually worked. Thank you.
[Magisk] SoloTSi97:
Your reply gave me hope! I have gone through the steps several times but Teams keeps reporting that my device is non-compliant. I'm using Magisk v23 on a Pixel 5 running Android 12. I'm guessing there's something about my setup that prevents this from working. I even installed older versions of Teams, Outlook, Authenticator, and Company Portal hoping that would do the trick. No dice.

I'm sure it's related to the fact that Company Portal seems unable to complete its settings check. When I tap "Check device settings", Company Portal starts to do something but quickly pops up a dialog that says "An error occurred during the settings check". That's using the 5.0.5147 version mentioned above.
[Magisk] DaCHeF36:
This worked like a charm. I think a main requirement is ensuring that each app AND ITS SUBCOMPONENTS are selected for hiding in Magisk. Just selecting the main app leaves things open. Nice work!
[Magisk] NIK3SH:
I followed all steps exactly the same (even with exact app version downloaded from apkmirror) but still during initial registration itself its getting detected for root and not moving ahead ...

Any guess ?
[Magisk] skuppej:
I am finding that the latest Zygisk (Magisk Alpha) + deny list enabled on CP/Teams/Google Services is working and let's me use the latest versions without needing Shelter or any other tricks. I also have Magisk Hide enabled and Universal SafetyNet Fix + Magisk Hide Props Config (with fingerprint) modules installed and I am passing SafetyNet. It even works with LSposed installed and running.

I suggest all to try this (and force close/clear data/restart on all apps after enabling Deny List) if you are still experiencing issues.
[Magisk] DaCHeF36:
After some more work on my Samsung device, I was able to get this working fairly easily. On my Note 4, running LineageOS 18.1 unofficial, all I had to do was enable all Magisk hiding options for Magisk itself, and all MS apps. I am able to use Word, Excel, PowerPoint, SharePoint, Teams, Outlooks, OneDrive, OneNote, etc. This is using v23.
[Magisk] coconutxyz:
is zygisk working with lsposed??
[Magisk] skuppej:
Yep- but you must use the alpha channels from the github/telegram for both
[Magisk] tomiasx22:
I made this procedure but then I took it a step further and installed Island to make work profile :)

I installed Outlook and Intune on my profile and then cloned them to work profile.

Then everything worked fine until I noticed one thing... when I set any method of screen unlock (there may be PIN, face unlock...) then after restarting, device bootloops when I try to put SIM cards PINs and PIN to unlock screen.

I have to immediately put them, wait 2-3 bootloops and when put all of them I successfully login to system.

Any ideas how to solve that issue..?
[Magisk] GohanBurner:
For me it was because I was running a different kernel. If I remained on stock then everything worked.
[Magisk] aygul12345:
What is now the process to whitelist the intune app?

I'm running magisk 23.0 but intune is not listed in the list.. So what to do now? Also I did check the system apps its still not listed.
[Magisk] skuppej:
Zygisk (Alpha channel) + Magisk Hide app stting + DenyList + (MagiskHide Props Config (add fingerprint) + Universal SafetyNet Fix)

(Last two steps might not be needed but will help you pass SafetyNet.)

In denylist add Company Portal & Teams. Make sure all toggles are selected on DenyList. Then force close and clear data on both apps and sign in again. Create work profile after all is said and done, if needed.
[Magisk] aygul12345:
Could you confirm that it works? Also do you use the latest intune app version?
[Magisk] aygul12345:
Also there is a Magisk V.24 released.

Is this compatible with it? Or Do I still need the Alpha Channel?
[Magisk] skuppej:
Hi @aygul12345 Yes- I came up with this fix after I heard about zygisk being better at hiding root. And it seems it does.

Nice- looks like v24 of magisk now supports zygisk natively now (about time). You shouldn't need the alpha channel anymore. I can confirm things are still working on v24 Alpha (should be same as general release).

And, yes, I run the latest version of Teams/Company Portal.
[Magisk] mr-mauro:
Hi, what do you use as a replacement for Magisk Hyde (that was integrated till v23) in the new v24?
[Magisk] skuppej:
Hmm..in Magisk alpha I am still seeing Settings > App > Hide the Magisk app
[Magisk] d4m4s74:
Does this plugin still work on the latest magisk/zygisk? Lookout for work keeps finding root.
[Magisk] skuppej:
No. This module is decommissioned
[Magisk] mr-mauro:
Oh yes that exist even in the final version. But I was talking about Magisk hide, to hide Magisk process to the apps. Not only the app changing the name ;)
[Magisk] skuppej:
v23 "Magisk Hide" = v24 "DenyList" ;)

Same thing, but better.

You should also hide the app to complete the transparency.
[Magisk] amit_coolcampus:
Not sure how is it better as both do the same thing.

Infact with deny list I cant use the xposed module ¨disable flag secure¨ for banking apps as they are in the deny list. Same is not the case using magisk hide.
[Magisk] skuppej:
It's more or less a rebranding, and it is zygisk that provides the lower-level access for hiding root. I have found that I no longer need to use xposed modules like XPrivacyLua to hide banking apps- Zygisk + DenyList works natively for everything that I had trouble with previously when using Magisk Hide. But xposed is still an option, if you need it. But you will probably run into issues when layering xposed modules together with DenyList for apps, yes.
[Magisk] amit_coolcampus:
Xposed is not a root solution. I agree with you that zygisk works well for the same, but xposed modules are used to fulfill other purposes. Like taking screenshot in secured apps, sms code module, pixelify module etc etc.
[Magisk] mr-mauro:
Oh wow thank you! I felt suddenly such a newbie 😂🤣
[Magisk] skuppej:
No worries : ) I'm learning all this too. But what I do know is my method works..and I recommend u guys try it!
[Magisk] mr-mauro:
I'm surprised because I was always reading that MagiskHide was getting removed with the move to Zygisk... So I wasn't actually expecting it was going to be basically still there, just slightly more hidden ahaha
[Magisk] aygul12345:
I can confirm that this worked out! On Magisk v24.

Thanks for your clear explanation what to do and hide. I can confirm that it hide my root And passing safetynet by MagiskHide-fingerprint. +1

Steps:

Zygisk (Alpha channel) + Magisk Hide app stting + DenyList + (MagiskHide Props Config (add fingerprint) + Universal SafetyNet Fix)

(Last two steps might not be needed but will help you pass SafetyNet.)

In denylist add Company Portal & Teams. Make sure all toggles are selected on DenyList. Then force close and clear data on both apps and sign in again. Create work profile after all is said and done, if needed.
[Magisk] aygul12345:
Yes, Im happy that you described the steps and how and what need to hide completely.

Could you tell me what to do when there is a OTA update of the phone?

Which steps need to follow to keep/maintane the root of the phone when there is a OTA firmware update of the phone?
[Magisk] skuppej:
I'd say that this is a different discussion entirely- I don't really advise taking OTA updates (which, depending on your device, can upgrade your BL and render it impossible to gain root afterwards going forward), and I would instead stick with custom rom updates like LineageOS or AICP, for instance. But, regardless, you will need to have Magisk v24+ installed always. If you can manage to keep Magisk going on OFW then more power to you.

As for app updates (Teams/Company Portal), you can let these update to the latest. They should continue working until Microsoft finds a new way to detect root, which will eventually happen.
[Magisk] aygul12345:
Im curently running a Xiaomi phone with a Global ROM official. I get that.

My question is more, what if there is a OTA coming out. What are the steps to do? Because Installing OTA flash the recovery back to stock. So that I lose Magisk. What is best step to take on?

- Install the OTA

- Before Reboot, install Magisk?

-...

-..
[Magisk] skuppej:
Not sure man- never worked with Xiaomi/GlobalRom. But typically you would want to remove magisk first, dirty flash the new ROM (or take OTA..), then reinstall magisk. But definitely check the Xiaomi forum/GlobalRom thread for their suggestions.
[Magisk] skuppej:
Personally, I don't ever really take rom updates or OTAs or dirty flash. I always let it go.. and then maybe once a year perform I will back everything up and perform a 100% clean rom re-installation with the latest version available. Usually results in less problems.
[Magisk] dejson:
I can say that yesterday I have unlocked bootloader and installed MIUI GO PLUS on my POCO X3 PRO, installed last Magisk 24, hide magisk from apps. Enabled zygisk. Installed fix for cts passing, even you dont have to at all. I deny my banking app in the list and it is working like a charm. I am working in a bank and was too scared to try intune, because if it fail, I will be reported. But I am sure that this method is working 100%.
[Magisk] Zvhdd:
I tried multiple times but still can't pass. Could you please advise if any mistake made in my attempts?

Device: Oneplus 6 stock rom (Android 10) with Magisk 24.1 in Zygisk and Shamiko module enabled.

I used Shamiko because DenyList is not enough for some bank apps.

It can pass Root Beer test for root and YASNAC for SafetyNet.

Install Teams and Intune from GooglePlay

Force stop and clear data/cache for both apps

Add them into DenyList

Reboot (for Shamiko to take effect)

Start Teams and try to login

(My company's policy is that you cannot enroll your own device, but just rely on Intune to verify your device is relatively "Safe")

Teams can login but Intune will prompt that you device is rooted and ask to remove account.
[Magisk] hoehm72:
Working for me on a Xiaomi Redmi Note 4 using mdroid custom ROM and Magisk 16.3

Great job!
[Magisk] image45:
So working fine on Wileyfox Swift 2 running with Lineage OS 14.1.
[Magisk] paarnoutse:
The latest version of the Hider module disables itself now after installation. Does this have any impact for upgrading your Android version (where I will reflash Magisk _before_ 1st boot of the upgraded Android)? Possibly the module has to be set to Enabled just before rebooting TWRP for installing/upgrading to the new Android + reflashing Magisk?
[Magisk] Dreamer(3MF):
If You Will

Upgrade The Rom (Not Installing Another Rom)

/

Reflash Magisk (Without Uninstalling)

, It Should Has No Effect On The Current Data/Settings Of Magisk.
[Magisk] Speederer:
Thanks, your solution works perfectly!

Anyway my company policy requires encryption, but I simply skip it. The notification appeared, but I didn't encrypt my phone. The built-in email client works fine also without it.
[Magisk] paarnoutse:
Tried it and you're right, it worked! After upgrading Android (installed a full update) and - before 1st boot - reflashing Magisk, all settings were kept and Intune (incl. subprocesses) stayed hidden. :good:
[Magisk] Dreamer(3MF):
Beta Version:

Current Beta Version: -

Changelog: -
[Magisk] spicediablo:
I'm on latest version 0.1.3 but today, it seems like intune is detecting my rooted phone. It used to be OK before this. Anybody faced this?

Sent from Sagit
[Magisk] image45:
I had an update on yammer app Early on however not intune app. Up to now nothing has change for me.
[Magisk] Dreamer(3MF):
Quick Guide For The Stable Version:

1- Clear Data&Cache Of Both Of Intune & Email Exchange Client (Such As Outlook & Gmail)

2- Did You Install BusyBox/Xposed? And If So, Disable/Uninstall BusyBox/Xposed.

3- Download The Latest Update Of IntuneHider4Magisk

4- Flash The Latest Update Of IntuneHider4MagiskThen Reboot
[Magisk] Dreamer(3MF):
Kindly Do The Following

- Did You Install BusyBox/Xposed? And If So, Disable/Uninstall BusyBox/Xposed --> Reboot

- Install RootBeer Sample From PlayStore & Send Its Screenshot

- Install SafetyNet Test From PlayStore & Send Its Screenshot

- Send The Screenshot Of PlayStore Device Certification Status

- Send The Full Logcat
[Magisk] Dreamer(3MF):
About Sending The Full Logcat: You Can Use One Of The Following Methods

- Download Terminal Emulator From PlayStore & Write

logcat | grep microsoft > log.txt

- Download Logcat Extreme (Or Catlog) From PlayStore

- Write

adb logcat -d > log.txt

For ADB
[Magisk] paarnoutse:
Just for your info, if you're running Android 8:

The 'Catlog' app doesn't work anymore at Oreo (at least not at my device, and I've seen same complaints by other users). I've replaced it now by 'Logcat Extreme' (SCDevs), which runs OK at Oreo.
[Magisk] image45:
There are many challenges when you move onto Oreo, aren't there!
[Magisk] swooperstar:
You guys are letting intune take over your phone though? Is there some other way around this?
[Magisk] Dreamer(3MF):
Kindly Check This Post https://xdaforums.com/apps/magisk/microsoft-intune-company-portal-t3611588/post76231988.
[Magisk] swooperstar:
Yes I get that this hides that you are rooted from intune. But you still have to install intune and let it control your phone, right?
[Magisk] rajackar:
Yes. No way around that for now.
[Magisk] image45:
Yes getting it to run, work on a rooted device is enough for me.
[Magisk] skuppej:
Are you also using Magisk Props with fingerprint and Universal SafetyNet Fix?
[Magisk] Zvhdd:
I tried both.

As stock rom, I didn't find it necessary to modify existing valid fingerprint (correct me if I'm wrong)

Universal SafetyNet Fix on or off doesn't make any difference: Root Beer (-) and Intune (+)
[Magisk] skuppej:
Sorry then....apart from trying to reinstall Magisk from the ground up or trying another rom, or maybe using Island, I am not quite sure what else you can try. This method is working for everyone else, which makes it seem like maybe Teams/InTune is detecting your root indirectly, maybe via something else that is installed or exposed on your device
[Magisk] Zvhdd:
Thank you. I'm able to use the outdated intune/teams/outlook combination, and try my best not to update any of them :)

By far intune is the only app I cannot trick :lol
[Magisk] dejson:
And what about scenario where I would like to use custom rom with no root at all. I don't want to take a chance at all to be flagged. Crdroid for example, will it work ?

Well, I took a trial for intune and have my own company portal registered for testing purposes, will see if it works.

EDIT 23h

I can confirm that everything work like a charm, I only had a problem with autoinstalling o365 apps automaticaly in my trial intune portal.

I have tested root with my own intune portal several times and not a single issue.

Finally I installed my real company portal and left phone to install all work apps in work profile, like 10 of them, I hide them all and eveything is beuatifull. So I tested couple of times, 10 at least, and had no isuess whatsoever. Only thing that is easy to forget is to disable autoupdate for each and every app in work profile. I can even install apk files on my own now, my company is device admin and fdroid and other apps can't get permission to install apps, unknown source are grey in my case.

Thank you @skupejj for all hints you gave to us.
[Magisk] GoodSoul:
This, very complicated, solution did not work for me. Therefore here is a simple and working solution to hide root from Microsoft Intune.

https://xdaforums.com/t/tutorial-ro...t-intune-to-make-it-work-with-magisk.4402273/
[Magisk] dejson:
Well, all you did is just a new thread with all information from this thread, which is nice to have of course. But all steps you mentioned are described here.