[General Topics] HUN_Gyuszi:
The following is only for research and education purposes, please use it for your own risk. No financial or legal responsibility is held by me. Please keep in mind that the act of modifying the software on your mobile phone might turn into violating the contracts and legal agreements between you and google and/or your employer or any other interested parties. Only continue if you understand this.

This is how I got it to work on my device and my setup​

For Motorola Defy 2021 (and similar GSI phones) with LineageOS 20 TrebleDroid.

Please note that there might be different possible solutions out there depending on your device, ROM and other conditions. My instructions are one version. You might use lsposed modules and any other stuff that works for you.

Guys after many hours of sweating blood I finally figured how to make teams + intune work on my phone.

Please note that it might not work on other phones. This is a GSI Motorola with LOS20 GSI (TrebleDroid) installed, so already using a custom ROM.

Let's break this into multiple seperate parts.

Part one: make safetynet and intune think the device is not tampered

This is some classic ****: install magisk, make it hidden in the settings menu, enable zygisk, enable deny list, enable force denylist, and pick your apps + google stuff like play services. Dont forget to force stop and clear data + cache of these denied apps before actually using them, because root detection can be sticky.

What modules I installed additionally:

GitHub - Magisk-Modules-Alt-Repo/sensitive_props: Reset sensitive properties to safe state, take from MagiskHide code

Reset sensitive properties to safe state, take from MagiskHide code - Magisk-Modules-Alt-Repo/sensitive_props

github.com

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/ (Universal safetynet fix 2.4.0 MOD by displax).

What NOT to install: lsposed, shamiko. I tried many hours of fiddling with them, without any luck. There are many cool lsposed modules out there, but you dont need them unconditionally. Shamiko needs to have 'force denylist' off, but that is actually against what we are trying to do here.

Part two: device simulation

Some companies only allow specific devices, like mine do it. They dont allow motorola, but allow others like samsung and pixel. This is not about making any changes to your phone. You can use your very unmodified, stock software motorola phone, but intune will say no. So, you need to make the software stack lie about your model.

You need to have https://github.com/Magisk-Modules-Repo/MagiskHidePropsConf installed.

You dont necessarily need all of this, but for example if you use a Treble/GSI ROM, you might need to pick the GSI-related option here without actually using some other device's fingerprint. You will notice that one if you read the menu of magisk hide props. You can ignore this subset in this case, just pick the GSI option. Other people can read forward.

You need to override device fingerprint to something that is allowed (most probably some recent samsung or pixel will do). After that, enable 'device simulation', and use the following: ro.product.(brand,name,device, manufacturer, model). ro.build.description, 'Use partition props'.

Also go into 'Edit MagiskHide props' and be sure to all is active there.

My advice is do this step by step and allow a reboot for each step. Time consuming, but you need to have patience here.

My other advices:

- if you use android 13 please use the latest pixel you can see on the list, like Pixel 6. It says (12), but that is not problem.

- you can always research any device fingerprint from the internet and type it manually. But keep in mind that google safetynet has a huge ass of database for what actual devices received android security patches when, so if your device fingerprint is something older but your patch level is too high, safetynet will guess that you are lying. There might be other vectors of such detection (and their solutions of course...). Depends on your phone and ROM.

- there is a 99% of chance that your android phone is arm64 bit. Please choose fingerprint for device that is also 64 bit. If you miss this and choose something that had a very early android version and/or the architecture mismatches, you might render your phone soft bricked.

Part three: use a bit old versions of teams and intune

Teams and intune company portal apps are updated frequently but good news is that Microsoft tends to allow using older versions. I use about 1 year old versions from Teams and Intune apps:

Teams V1416/1.0.0.2022317002: https://apkpure.com/microsoft-teams/com.microsoft.teams/variant/1416/1.0.0.2022317002-APK

Intune company portal: V5.0.5421.0 https://apkpure.com/intune-company-...wsintune.companyportal/variant/5.0.5421.0-APK

Avoiding tampering detection is not a static area. Google safetynet and other solutions are evolving each day. If you set up something that works might break the next day. Newer versions of teams and intune might pull in new kinds of tampering detection, this is why you might need older versions. I made this stuff on my tablet and phone too, and I think latest versions are harder to cheat on.

Cheers and good luck!