yashsingh1/xdaforums huggingface dataset:
[General Topics] morpheus133:
In my setup Microsoft Intune create an workprofile, and company install the nesecerry apps there. (Teams, Outlook)

From the begining of September Outlook and Teams start to detecting root.

But intune is working well. (It says Device Status OK)

So i think the problems are with the app in the workprofile. Somehow they break out from the profil and detect the root.

In the normal profile I use "Hide My Applist" and hide evrithing from the apps. (Also intune is visible there)

But the apps from Workprofile are not visible there, so I cant hide them. Maybe this can solve the problem, but I am not able to install it to workprofile.
[General Topics] TnargNaanac:
This is the exact behavior I am seeing. I am on Magisk 26.3, using Zygisk, Shamiko, and SafetynetFix. Intune states that device is healthy, but Microsoft Office apps and Teams are detecting root since about September 5th.
[General Topics] mGforCe:
Hope you have hidden Outlook, Teams etc in Magisk Denylist and then disabled deny list.
[General Topics] TnargNaanac:
Yep, everything was working for the past 6 months until this week. Interesting that company portal thinks things are fine but not the other Microsoft products.
[General Topics] mGforCe:
Ok, then have no solution here.
[General Topics] swieder711:
I suggest trying to roll back Intune to an older version. The July 11 release is working for me.
[General Topics] TnargNaanac:
My company portal is managed, I don't think I can roll it back without completely wiping out my whole work account. How did you roll back?
[General Topics] digger16309:
Or roll back the apps if you can. And, hide Magisk if it isn't hidden and renamed.
[General Topics] swieder711:
I downloaded the Jul version from apkmirror and installed it. Then I disabled auto update for it in the Play store app. I don't remember if I removed Intune before installing the older version.
[General Topics] morpheus133:
My also.

But I Install XDowngrader and it allow to install older version top of the new.

Now it works, but who nows till when.
[General Topics] TnargNaanac:
I can enable Xdowngrader for my work profile, but I can't install apk directly into the work profile, only my main.
[General Topics] morpheus133:
In my case there were two Intune app.

First I install one on main profile. This create and handle the workprofile.

In work profile, company also install one intune. I only update the one in the main profile.

But it seems only a temporary solution. (After some ours the app was updated. And most probably not from google play.)
[General Topics] morpheus133:
Now I will try to use this version update lock:

https://xdaforums.com/t/mod-xposed-...e-your-apps.4433253/page-8#post-88973913Maybe it will block the update.
[General Topics] TnargNaanac:
I can get Company portal to verify my phone is OK now after rolling back the version, but it seems like the individual apps (outlook, Teams, etc) are able to detect now.
[General Topics] swieder711:
You might need to clear memory and cache on the apps to get them to not detect root. Or try uninstalling all the apps and see if you can get them working one-by-one. Be sure to hide all the pieces for each app in Magisk.
[General Topics] supermansaga:
5.0.5981 finally showed up on play store today for me and it indeed detected root. This is unfortunate. It has been a good run. Guess I will have to switch back to iPhone 15 then. The cat and mouse game is very tiring. It's only a matter of time. Exactly what I needed ahead of Apple's iPhone 15 announcement event on 9/12/2023.
[General Topics] xXfreshXx:
Just disable root? You don't have root on iOS either?
[General Topics] supermansaga:
no, because I heard jailbreaking iOS is of a much slower progress. One won't be able to use the latest iOS 16.6.1 if not iOS 17 beta? Prove me wrong. Even if jailbreakable at 16.6, I double it could survive the new onslaught from intune company portal.
[General Topics] xXfreshXx:
Just buy your iPhone. I don't care. You have to prove yourself wrong. It's your money.
[General Topics] morpheus133:
In my case both 5.0.5981 and older version of it was verify phone as OK. (So I thing hiding was ok)

In case of 5.0.5981 the invidual apps (what was installed in workprofile) detect the root.

So most probably they implement something to reach out to main profile from workprofile...

In your case:

What does Momo says about your phone?
[General Topics] supermansaga:
I noticed the nuance now. Company portal indeed says the device meets policy, but Outlook and Teams let us down. I re-added company email and it worked for a very brief moment, before exiting again. What's momo? Thx
[General Topics] vukis:
My initial situation was quite similar: company portal was green, but outlook and teams were throwing get access dialog with Green marks for "Recent connected", "Device is supported", "Everything is up to date", but "Device is healthy" was red. Upon clicking continue it showed that fallen ice cream logo with notification, that phone is rooted.

Thank you @swieder711 ! Company portal version 5.0.5926 did the trick.

At first I tried downgrading from 5.0.5981.0 to 5.0.5450.0 (From what I had in swift backup).

Swift backup could not downgrade. So I removed work account completely, enabled company portal app on main profile, uninstalled

Then I restored 5.0.5450.0 from swift backup, disabled auto update in play store, opened magisk deny list. All except one was already ticked. The one missing was: .....re_missing_splits_activity. Ticked that one

Then Logged into company profile, created work profile, downloaded teams in work profile. And then teams reported, that my company portal is outdated.

So I went to apk mirror, downloaded 5.0.5926 apk and just installed using my main profile. Company profile version changed in my main profile and in work profile. I think there could only be one version of app per different profiles.

Right after that I launched teams, logged in and it started working again. Tried a few times and still works.. Just installed outlook from play store install was instant (probably just took my main profile app) and it works like a charm :)

P.S. It will work till teams decides that company portal is outdated, or fixed for newer version :-)
[General Topics] supermansaga:
5975 should be the last known version that can stand this for a while
[General Topics] GoodSoul:
Does Basic integrity or CTS profile fail? Or both? What is your device and android version, also which fingerprint did you select?

Sorry, was away for some time. I checked your entries and can only see that the app is whitelistet (zygote). You did expand the view before clicking the enable button, right?

Not sure if this is the issue. I will try to find out whats the difference is.

Edit: What Android version is your S9 running?

Also interessting: https://www.xda-developers.com/how-to-pass-safetynet-android/
[General Topics] Indru:
Both fail. Strange thing, it seems the fingerprint does not apply. After rebooting I have the same fingerprint. So there is something wrong with the props. I have the latest version of Magisk, latest version of Magisk Props Config.

OnePlus 5T, Android 10.

Also another strange thing: Yasnac says device ID is A0001 instead of A5010 (OP 5T)
[General Topics] GoodSoul:
A001 is the OnePlus One. Did you catch the right ROM for your device? :)
[General Topics] Indru:
Hi,

Yes, I have OxygenOS 10.0.1 for OnePlus 5T (official firmware). In About phone it says OnePlus A5010, nothing is off there, just Yasnac doesn't seem to read it correctly, and if I try e.g. to assign fingerprint from a different model (like 8 Pro or something) when I reset I still have 5T fingerprint according to props.

LATER EDIT: SOLVED IT!

I have went into the props menu and reset the props settings to default. It seems there was some wrong setting somewhere. Afterwards I assigned the fingerprint and now YASNAC sees the model correctly, and if I add the Universal SafetyNet Fix it passes integrity checks.

Everything OK! :)
[General Topics] persmash:
Hi,

Both are passed. See attached. Galaxy S9. Android 10.

Yes I have expanded the view before selecting.
[General Topics] persmash:
Still no luck...
[General Topics] A.L.P.H.A.:
I have performed all the steps, after logging into intune, it is asking me to set up a work profile, and since I am using a custom rom (syberia 5.4 for oneplus 6), it is "not encrypted" hence, I cannot set up a work profile.

Kindly help me out here.
[General Topics] Mephisto01:
Hi @GoodSoul ,

Thank you for the prompt description!

I can now use all of the company stuff on my rooted Ulefone Power Armour 13 phone.

I saw, that this method should be good for Google Pay too.

After doing the steps I could add my card to it and I will test it soon in a shop.

Hope it will work!

And again many-many thanks to you!
[General Topics] Mephisto01:
Hi @tiga05 ,

I'm on Magisk 24.3.

I also experiensed such behaviour, because my company started useing MS Authenticator and Intune to access company data on personal phones.

Sometimes it was enough to hit one or twice the contiue when it cried about the root, and eg. the outlook started normaly, but sometimes it just closed the outlook.

After I done the steps in Goodsouls workaround, I was asked to set a PIN, and all the company stuff started working flawlessly.
[General Topics] EpHYN5kR:
No success, both yasnak tests passing, but root is still detected when try to use a banking app or ms intune. Using a LE2123 (OnePlus 9 Pro, OOS12).
[General Topics] mancman:
Thanks a lot, for telling about the expanded view in hide.

This saved me a lot of hassle.

Very much appreicated.
[General Topics] traversone:
latest 5.0.5519.0 IntunePortal detects root again!

all stuff described here seem not working since yesterday
[General Topics] Viraxe:
Indeed, same here :-(

YASNAC still passes both basic integrity and CTS profile match (evaluation type BASIC), but Intune Company Portal somehow detects a rooted device.

Running Magisk 24.1 with Zygisk, Universal SafetyNet Fix 2.2.1, Props config 6.1.2-v137, running OS 18.1 on a Samsung Galaxy S7, appearing as a S20 running Android 11 via props config...
[General Topics] tangcla:
Thanks, Magisk Hide worked for me

I had to hide Company Portal, Intune and Teams.
[General Topics] lugremo:
I had the same issue with the updated intune portal 5.0.5519.0

Previous version worked for me 5.0.5472.0 which i dowloaded from apkpure. Closed the automatic updates from the google play store.

But I don't know if there is a solution for the latest portal app.
[General Topics] deep_raman:
This no longer works after 31st May'22. YasNac shows pass for both.
[General Topics] deep_raman:
Downgrading to intune worked for me. Thanks
[General Topics] dohanin:
i've updated Intune to the latest version 5.0.5533 and it's still working fine. I'm using the Shamiko module (v0.5 build 100).
[General Topics] futasay:
I pass the integrity check, and have tried:

- Downgrading to 5.0.5472

- Using Shamiko module to hide while on both the latest version (5.0.5533) and the downgraded version

- Hiding Magisk APK

Not sure why it is still getting triggered - it says device is in compliance, but then Company Portal spams my notifications with "rooted device detected, wiping data", and it won't generate a work profile (which I need).

Going to try manually generating a work profile with Shelter, but I don't think it will work. Does anyone have any ideas?

EDIT: I tried Shelter and it seemed to work, but the app did not generate a work profile, which is weird. The contents of the app were blank as well (no company apps, etc.).

Android version: 11

Device: Pixel 4 (flame)

eval_type: BASIC
[General Topics] supermansaga:
please just go away if you have nothing to help. Silence is golden.
[General Topics] digger16309:
You indicated you were likely moving to Apple/iPhone.

This suggestion below was meant to indicate that the situation would not be better on Apple and aligns to what you wrote:

This question may have been too short in phrasing, but the meaning was, if you are going to purchase an iPhone 15, why not just operate your current Android phone unrooted since the result will be the same?
[General Topics] supermansaga:
I need it rooted for certain purpose and just lament the company apps won't work anymore without downgrading. After watching the iPhone 15 Wonderlust event, I can't rule out buying one, even though I hate their bundling of the apple watch and lack of one physical sim slot. The single deciding factor is really just the company apps which I hope there is a solution and your camadarie and empathy
[General Topics] zgfg:
You flash back your stock ROM and relock Bootloader (it will do Factory Reset) and you will have certified phone passing Play Integrity, all kind of root detectors, working with all banking apps, company apps, whatever. And with all the app versions, now and in future

That's the point. It's not Android/Google fault but users who unlock BL, install custom ROMs, root and cry then why the apps detect 'root' - actually they detect and complain that phone was modded.

They should have not unlock BL in the first place and they would not be able to mod, hence they will have no issues

On iPhones, users do not 'root' (jailbreake) and they can praise then how everything works fine there
[General Topics] Olorin92:
Same thing for me on my Pixel 7 Pro this morning - the intune app itself reports the device as being compliant, but the usual apps I use (Slack and Outlook) both report the phone as being rooted.

Have tried clearing data for all the work apps with no success. Intune is managed in a work profile, so not sure what options I have for downgrading/locking the version given it's all managed in a separate profile. Also tried updating shamiko and usnf with no luck.

Any advice here?
[General Topics] ykjae:
Same here for me. I've downgraded all and wiped data of my Microsoft apps and reinstalled shamiko, play integrity fix, re-configured both hma and denylist. I'm not sure where to go from here.
[General Topics] vukis:
Edit: forgot to quote previous posts. Sorry for double posting below

Temporary workaround:

Remove your work profile completely.

Uninstall company portal from main profile

Install earlier version (5.0.5926) of company portal from apk mirror or backup if you have

Open magisk and reinforce deny list for all tick marks of company portal

Open play store and disable auto updates of company portal

Setup working profile

Open working profile play store and disable auto updates in there

All apps which are present on company portal should also be downloaded to main (or do they already co exist) and those apps should be added to magisk deny list.
[General Topics] vukis:
Temporary workaround:

Remove your work profile completely.

Uninstall company portal from main profile

Install earlier version (5.0.5926) of company portal from apk mirror or backup if you have

Open magisk and reinforce deny list for all tick marks of company portal

Open play store and disable auto updates of company portal

Setup working profile

Open working profile play store and disable auto updates in there

All apps which are present on company portal should also be downloaded to main (or do they already co exist) and those apps should be added to magisk deny list.
[General Topics] Olorin92:
Thanks will try this one out and report back!
[General Topics] Olorin92:
OK for now this is working - thanks for the tip @vukis! Here's to hoping there's some workaround which allows us to update at some point...
[General Topics] morpheus133:
Dont need to remove workprofile.

Just "update" To Older version!

Use XDowngrader or any other mod what allows downgrade.
[General Topics] vukis:
I tried restoring from swift backup and it complained about older version. So I decided, that it would be quicker just to wipe out everything and reinstall, then getting XDowngrader :-)
[General Topics] Olorin92:
Does this work from within the work profile? Will be useful going forward if it does and I accidentally update...
[General Topics] ykjae:
So I finally got outlook/SharePoint/teams to work.

I don't have a work profile set up as my set up is mam vs mdm. I used application manager (fdroid) and disabled some things as mentioned in page 10 of this post.

The suggested list caused force closes so I took a guess and disabled what I thought might get in the way of company portal.

As of right now I am using all my Microsoft apps without company portal. It is installed but not logged in if that matters.

Still using lsposed, hma, shamiko, usnf/pif (either one)
[General Topics] supermansaga:
Xdowngrader v1.1 at https://github.com/Xposed-Modules-Repo/com.alex193a.xdowngrader seems to have crashed my LSposed 1.9.1. Can no longer open the LsPosed via the shortcut or *#*#5776733#*#*. After deleting LSPosed data and retype the secret combo, LSPosed is back on. However I have most appetite for this module. Also tried Let Me Downgrade and it wouldn't work either. So I just removed my work profile which would delete all work apps. The I went to apk mirror to find 5975 and reinstall. It has been a charm. Need to disable auto update for Company Portal for sure so that it won't go back up to 5981. But the inability to press "update all" in the play store app annoys me.
[General Topics] vukis:
Bad news everyone. Company portal still got updated even if it's checked to not allow updates in both main profile play store and in work profile play store.

Rerunning whole downgrade process with work profile removal still works. Will need to analyze that xdowngrader, But I don't have xposed :/
[General Topics] spida_singh:
I just found this overnight, intune reported rooted regardless of what i tried.

My solution.

Completely uninstalled magisk (I was using Delta)

Remove your work profile from android system / accounts

Uninstall Intune Portal

Installed latest Magisk Alpha from here: https://install.appcenter.ms/users/vvb2060/apps/magisk/distribution_groups/public

I installed via adb sideload

Open Alpha app, you will have to update, and then it requires an additional update

reboot

you will then get a message asking to install again, select direct install

reboot

Just follow the instruction / prompts until you boot to magisk without any further update prompts

Dont bother hiding the app

Enable Zygisk

DO NOT ENFORCE DENYLIST

Install Intune latest version from Play Store (DO NOT OPEN IT)

Configure denylist

Add all apps that you want to hide from root ( i added usual banking apps, and Microsoft Intune)

Install Shamiko Module (im on 0.7.3 (174) (Shamiko 'reads' the denylist)

Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com

Reboot

Setup work profile etc using Intune

Install all other work profile apps (dont open them)

Add new work profile apps to deny list before opening them

Work apps are again now all working again fine with Intune / work apps.
[General Topics] Killer-User:
It works for me once I installed old apk...I disabled auto update of apps...also disabled network over Play Store
[General Topics] ldeveraux:
You just sound like an Apple fanboy at this point. I don't know who you think you're threatening by switching, but nobody's keeping you here, on this Android development forum. If you think the grass is greener, go for it.
[General Topics] TechX1991:
There is nothing special about that iphone. So far, it seems the same as the iphone 14 in many ways. Apple sucks, don't do it. Don't feed the beast.

What I eventually did was started carrying 2 phones. Problem solved
[General Topics] supermansaga:
Have you looked into the A/B slot thing? Maybe that solution might work so no need to carry two phones
[General Topics] supermansaga:
Big words by using "threaten". Who is threatening whom now by raising the temperature of the discussion unnecessarily. I am waiting till Oct 4 event. Already dislike the fact that US iPhone 15 pro lacks physical nano sim
[General Topics] spida_singh:
@super

Hey

I was refering to my post here:-

https://xdaforums.com/t/tutorial-ro...h-magisk-update-q3-2023.4402273/post-88996973
[General Topics] ldeveraux:
This is how your comment sounded to me:

"I'm going to do it guys! I'm going to buy an iPhone! Nobody can solve my Android problems that everyone else is also having, so I'm going to move to a device that can't be rooted. This, despite the suggestion to just unroot my phone, which is essentially what I'll be getting with an iPhone."

But again, do whatever you want. You don't need to announce yourself every step of the way.
[General Topics] mGforCe:
+1 Does this work in Work Profile too?

I also have same issue as few other fols reported. Suddenly Outlook has stopped working saying device is rooted. But Intunes says device complaint even when I rechecked.

From Playstore in Work Profile, cans see that Teams was updated today. Outlook got updated 3 days back. I had missed disabling auto-updates here :(

EDIT: Downgraded to older version of Company Portal v 5.0.5926) from apk mirror and all working well.

You need to install in main profile, seems like automatically gets updated in Work profile too.

Let's see for how long this works.
[General Topics] mGforCe:
Hi Spida, did you try removing work profile and adding again with Delta? As reported by few in earlier threads eg. by @vukis
[General Topics] mGforCe:
You were ahead of us... Same thing reported by many between yesterday / today
[General Topics] morpheus133:
If your workprofile was created by intune it is enough to downgrade the intune in main. Than both version will be the same.

No need to do anything with teams and outlook. They report the root but because somehow intune send this info to the workprofile.
[General Topics] supermansaga:
You misinterpreted big time. That's all I would say. Look at what I said exactly and the posts that followed and the temporary findings I have brought to the table. Assume good faith
[General Topics] ldeveraux:
Fair enough. Jailbreaking is a thing still afaik, just in case you did feel adventurous.
[General Topics] supermansaga:
If you could please take me to the latest discussion, I will bookmark it and try on my iPhone 13 pro max. Many thanks
[General Topics] mGforCe:
Thanks, this worked.

Request all, can we avoid OT and focus on making Intune / Microsoft work on Android
[General Topics] spida_singh:
Yes tried that, for me, nothing with delta worked
[General Topics] docluv01:
This worked, used titanium to restore a version from July 14 (5926), rebooted and good to go (for now)

EDIT: Reboot was not required.
[General Topics] Quake94:
Am I missing something? I downgraded to 5926, initially everything worked fine but I think Outlook, Teams etc. got updated and now they detect root. Is there a workaround to have Outlook/Teams work with newest update?

Im sitting on regular magisk with USF displax mod, lsposed and shamiko
[General Topics] spida_singh:
This works for me

https://xdaforums.com/t/tutorial-ro...h-magisk-update-q3-2023.4402273/post-88996973
[General Topics] Olorin92:
Is this working with the latest intune version? The only big difference I can see between what you have done and what I did is that you're using magisk alpha
[General Topics] Quake94:
Ok, so I confirmed this method works and MS apps are working too. I tested it on Intune 5926. XDowngrader and Update Lock modules are required because Intune can get force-updated overnight despite the auto update disabled in the Playstore.

I have used the below guide to directly switch from stable to alpha w/o adb.
[General Topics] mGforCe:
Ok. Will keep this in mind if forced to upgrade my Intune version.
[General Topics] vMAC:
5926 worked for me. Used Xdowngrader and Update Locker.
[General Topics] supermansaga:
This doesn't work for me. Shamiko can't enter whitelist mode anymore per the old teaching at https://magiskcn.com/shamiko-whitelist. My Bilt banking app also detects root. Thanks.
[General Topics] spida_singh:
Have you tried blacklist mode? This still works fine for me