yashsingh1/xdaforums huggingface dataset:
[General Topics] DrPhant0m:
I haven't had the time to try anything different yet, sorry. For now... I've just been restarting my phone and using the first few minutes that I'm able to access everything to respond to an email, Teams message, etc.

A valid theory is that the custom ROM from DrKetan is modified (unencrypted among mods) in a way that makes it easily noticeable to InTune within minutes of restarting. A stock ROM, followed by rooting it with the approved methods in this thread might be a better move as far as InTune blocking things goes.

Unfortunately, I haven't even updated to the newer version of the ROM for my phone, let alone use a stock ROM and root it.

If I try anything new, I'll report back. If you happen to find anything, please do the same. Thanks!
[General Topics] Drahy:
Hello all,

Thx for all for the tutorials here... I was able to pass the root detection... But now I would like to cancel the device policy within the Microsoft Intune app... My company setup is that we need to enter 8 digit password everytime I open the app... It is horrible. I was able to bypass that in Outlook with LsPosed module called the dark tricks. Is there something similar for Intune app to bypass admin restrictions and device security pass checks?

Thank you!
[General Topics] laolaxyz:
Thanks - I will do. Its working somehow with enforce sulist but then the phone becomes extremly laggy. And it is just for houres... So not a real solution :-(
[General Topics] codd:
Same with the 8 digit pin. We can only hope.

I noticed some of my work profile apps crash as soon as I actually try to use function in them, like with outlook if I search it just closes. May just be how I imported settings though. Otherwise this approach in first post is working for me on Android 14
[General Topics] mGforCe:
Sharing Observation

I have been using Magisk Delta (now Kitsune Magisk) to hide Intune/Company Portal and make Outlook & Teams work - for the last few months.

Today was greeted with error that device is non-complaint. Now I had done 2 changes related to my setup:

1) Updated Kitsune to latest build R657C2E65-kitsune (26403)

2) Updated Shamiko to latest build v0.7.5

Not sure who was creating the issue, but I disabled Shamiko and voila everything was working well.

So, sharing for information with users rooted with Kitsune Magisk + Shamiko

PS: My Outlook, Teams app are always updated.
[General Topics] quantumsoul:
I have followed the all the steps mentioned in the tutorial after installing company portal, outlook and teams. YASNAC says all are pass. However, when I try to set up outlooks, device admin detected as a rooted device and deleted org data. Please help.
[General Topics] zgfg:
Did you really follow ALL?

YASNAC and deprecated SN are not relevant but Play Integrity
[General Topics] quantumsoul:
Yes I followed all. I couldn't follow the CTS profile match step as my mobile (Qin F22 pro) won't support finger print scanner. What could be wrong?
[General Topics] zgfg:
CTS profile has nothing to do with your hunan's fingers and the fingerprint scanner on your phone

Fingerprint in that context stands for the certified fingerprint from your official/stock ROM, lke:

"meizu/meizu_16T_CN/meizu16T:9/PKQ1.190616.001/1568972225:user/release-keys"

No fingerprint scanner will read that😁

And again, instead of testing SafetyNet with YASNAC, you must test PlayIntegrity with eg thenbuilt-in Play Integrity checker in the Playstore app (Settings, General, Developer options - must be enabled, Check Integrity)

You could pass SafetyNet with YASNAC but in the same time not passing Device Integrity for PI, and since Google, MSFT and others have switched to PI, you will be in the problem

So please study the instructions in this thread, make sure to understand terms and use the proper tools (google when necessary)

Yes, things are complicated, you will need to study also the other related threads on XDA like Play Integrity Fix and to use its Magisk module, etc

Of course, the easy way is to stick with unlocked Bootloader, official/stock ROM, no 'root',' etc - and then there will be no problems with Play Integrity, Intune, etc
[General Topics] snoopsean88:
So I followed instructions and it didn't work. Here is what finally fixed it for me

I'm on motorola g7 power android 9 security patch 2020-06-01 Google play 23.48.16.

Turns out I had to install the latest magisk 26.4 (app and magisk) and the latest shamiko 0.7.5. I had a slightly older magisk (it was newer than the version in this tutorial) but it was still causing problems. I also cleared Google play services data. Interetstingly though, I had to check the box for "enforce denylist" in magisk settings. The tutorial says uncheck, but it didn't work for intune or other apps for that matter til I checked it.
[General Topics] quantumsoul:
When I used Play integrity scanner, only basic integrity was passed and other two failed. Regd. CTS profile,

When I used Play integrity scanner, only basic integrity was passed and other two failed. Regd. CTS profile, I installed the zip but when I opened terminal emulator and gave the first command as instructed it keep on going and it won't stop. How can I fix CTS profile. To be Frank, I'm hearing for first time. Detailed steps would help. Thank you
[General Topics] quantumsoul:
When I used Play integrity scanner, only basic integrity was passed and other two failed. Regd. CTS profile,

I also tried attempting to configure Teams and outlook after enabling enforce denylist and surprisingly it worked like charm.

Edit:It didn't work after reboot
[General Topics] killswitx:
the CTS when doiing fingerprint select and i have android 12 so then what should i do to select still 11 ?
[General Topics] quantumsoul:
Not sure what is going on. It seems things are currently working fine. I didn't do anything differently from the tutorial instructions.
[General Topics] quantumsoul:
After few hours and after reboot, Teams app detected root, and deleted org data. What the hell is going on?
[General Topics] quantumsoul:
I have followed the steps after installing MagiskHide Props Config, but I couldn't find my phone model Xiaomi Qin F22 pro. Please advise what should I do?
[General Topics] snoopsean88:
Try installing the play integrity fix module by chiteroman. With that I ended up disabling magiskhide props, removed shamiko, enabled the denylist, and wipes teams and Google play data. working great even after reboot and after a day teams doesn't think I'm rooted
[General Topics] quantumsoul:
Play integrity fix was already installed. Now, it seems all doors are closed.

Can anyone give me any hope pls
[General Topics] jbradshw:
I'm another victim to this. I installed the integrity fix module, and was able to find a fingerprint to pass the DEVICE_INTEGRITY in the integrity checker, but when I try to reinstall the Intune app and run it, I get a hard fail at the beginning (before it even checks for root) saying my device isn't allowed - contact my IT admin, etc , so I'm thinking some of these "good" fingerprints aren't allowed.
[General Topics] laolaxyz:
So - actually I accepted the fact that I can not bypass Intune with my S21U anymore. However, I was curious what the Shamiko module actually does and I started to read a bit on Github about it. There I found an interesting hint:

You can create an empty file /data/adb/shamiko/whitelist to turn on whitelist mode and it can be triggered without reboot

Whitelist has significant performance and memory consumption issue, please use it only for testing

I gave it a try and it is actually the remaining piece of bypassing Intune (please note that you should have already installed Magisk and passing the Google Play Integrity check). I am not already sure about the drawback with the performance issue (there is once in a while some stuttering - but this happened also before (maybe less often ?). However the battery consumption seems to be higher (not sure about this either).
[General Topics] zgfg:
Everything you do with the Whitelist mode can be also achieved by putting all the needed apps/processes to DenyList (blacklist mode) - and of course, Enforce DenyList must be disabled to let Shamiko read the DenyList (blacklist) and hides from all in the list

Whitelist hides from everything except those in the whitelist.

Blacklist hides only from those in DenyList (blacklist)

In Whitelist mode, X must not be in the whitelist and Shamiko will then hide from X, the same way as if X was in DenyList for the blacklist mode
[General Topics] laolaxyz:
I theory you are certainly right. for most of the ROMs. In praxis there are some ROMs which don't work with such a process. I.e. Samsung S21Ultra... It's not only I who wasn't able to bypass Intune but a some other peoples too (just read some pages back). Using the deny list as proposed (for sure, properly configured and also storage cleared) just resulted in "you are rooted". Using the enforce denylist "enabled" resulted in a temporary success (between minutes or hours after a reboot) - then the message "you are rooted" came back. Beside of this, the ROM became laggy and some system apps did crash. So nothing you could use.

With the whitelist, everything is working for 2 days now. And actually I don't see a noticeable disadvantage to do so (at least the battery lifetime is basically the same and also the phone behaves as before).

Again - when you can bypass Intune by using the deny list (as described in the first post) - be happy and no need to use the whitelist method. This hint was for those peoples who weren't successful so far and actually already gave up...
[General Topics] quantumsoul:
My device performance was significantly improved and user experience peaked as if I'm using an high end phone after the rooting... after resetting and following all the instructions one more time, Intune, outlook and teams started worked already since I posted the issue here around a couple of weeks back..

Unfortunately, the problem reappeared. I'm sure I'm not doing anything wrong.. Outlook and Teams started reported that my device was rooted and org data was removed..No help after following SOP of clearing cache of all apps including GPS.. In fact, i did it for several times..

I'm stuck and really need your help. How can I use outlook and teams again.

FYI.. I have increased Zram to 8GB recently and my phone has become butter smooth though it came up with 4GB RAM.. is it a problem..

PS: I sold my S23 after I believed my low end phone is working perfectly fine..
[General Topics] laolaxyz:
see post #616
[General Topics] quantumsoul:
N

thank you but no need of any more suggestions as the problem fixed after reinstalling play integrity module which got somehow uninstalled.. the OP is Bible.. it is still working..
[General Topics] zgfg:
Just don't forget that Teams require Get Device Info aka READ_PHONE_STATE permission

AFAIK, it was discussed here but we easily forget 😬

This weekend I did clean install.for a new version of my custom ROM (Xiaomi.eu) and since then I had troubles to get the Teams working - I don't have Intune but Teams were just immediately force-closing

Once I was 100% sure that I properly set all the needed root hiding techniques and when I successfully solved similar issues with few other stubborn apps seeking for 'root' (but Teams were still force-closing), I finally looked into the logcat:

logcat -d | grep teams

and found there:

01-03 21:00:13.209 6337 6783 D DigestGenerator: digest=============com.microsoft.teamsjava.lang.SecurityException: getCallState requires READ_PHONE_STATE for apps targeting API level XX+.

So I found in my native Settings how to grant the required permission (screenshot) and that finally solved me the last obstacle to launch Teams
[General Topics] supermansaga:
Regarding the OP is bible....it really hasn't mentioned the play integrity fix by either osm0sis and chiteroman, right? MagiskHide Props Config from 2021 totally breaks my Magisk Canary 26404. I think the OP should really update the walkthrough for Magisk Canary 26404 and Pixel 8 Pro.

See this post by Fishawy
[General Topics] quantumsoul:
Agree, it seems someone advised me to install Play integrity fix as a response to my post but I didn't realize this was missing in OP. It would be great if OP can be updated with the missing details.
[General Topics] adinechin:
On my side, no need to use PIF, I only use Shamiko and Universal SafetyNet Fix

Sent from M2101K6G using ReLabs
[General Topics] Bodochecker:
Hello everyone, i hope this here is the right place for my question

My phone is running on project elixier (Android 13) and twrp. I also do need the microsoft intune app, did all steps from the tutorial but when it comes to creating a work profile, there is a message saying my phone is not encrypted.

In Settings -> Security & Credentials -> it says phone is not encrypted.

Is there a solution for this?

Thanks in advance
[General Topics] adinechin:
Yes, the portal should give you a shortcut to your parameters to trigger encryption. Or you can go yourself in the parameters to encrypt your phone.
[General Topics] Bodochecker:
Hey, do you mean by pressing on the Phone is not Encrypted text? That i found on Google also but does not work for me
[General Topics] adinechin:
I don't understand your question, but search in your phone's settings, in security you should have an entry on encryption and be able to encrypt your phone.

The encryption is mandatory for work profiles and encrypt all your data on the phone.
[General Topics] zgfg:
Maybe you have custom ROM with the encryption disabled/not supported
[General Topics] Bodochecker:
This is what i did or at least tried to do. It just wont do anything when i click on encryption
[General Topics] Bodochecker:
Is this common on custom roms?
[General Topics] zgfg:
Depends on developers and users/community who may prefer

Of course, they probably don't use Intune or other apps that complain about, hence they don't care

Anyway, I would never have non-encrypted data - for the sake of my own safety
[General Topics] Bodochecker:
Well, i think my question is solved now, or kinda. At least i know what the problem is, thank you very much :)
[General Topics] Quake94:
So it was working for me until recently. I am running PIF, Shamiko, magisk alpha. Basic integrity passes. For whatever reasons, work apps show error that integrity isn't passing. I've cleared cache of play services and play store, restarted phone and issue remains. YASNAC passes basic integrity. Company portal shows in compliance. Help?

Removed account, cleared cache, reinstalled portal, denylist configured properly. In my main profile Play Protect is certified, but in work profile it isn't
[General Topics] zgfg:
Please check in the Play Integrity Fix thread, to be up-to-date

Don't use YASNAC but PI checker app - and you must pass Device Integrity

If you used PIF module with its own prints, they are now blocked by G, and from now on you must find and use your own PIF json file with the working prints. How and why, all is explained in that thread - or check PIF module Readme on GitHub and/or PIF TG channel
[General Topics] Quake94:
Can you

I've tried looking up the PI Checker app but it's too broad - can you point me to what app should I use for check?
[General Topics] zgfg:
Search for Play Integrity on the Playstore

Actually, this is the link - (I want to test something regarding the XDA Forum app and links to the Playstore😬):

Play Integrity API Checker - Apps on Google Play

Get info about your Device Integrity through the Play Intergrity API

play.google.com
[General Topics] adinechin:
I would suggest https://play.google.com/store/apps/details?id=com.henrikherzig.playintegritychecker on my side
[General Topics] natesc0tt:
same, here. company portal checks and says device is okay. teams and outlook find device "not healthy" (ie. detect root). i hoped the latest Magisk beta 26404 with latest Shamiko v1.0.1 would fix but not luck. not sure which is better, to use shamiko or to enforce denylist. can't have both at the same time.
[General Topics] adinechin:
I already had this kind of issue, I'm still with latest shamiko and magisk canary.

My solution when this happens : kill all running apps and retry. Works like a charm for me 😉
[General Topics] DrPhant0m:
Update: It took a little while with a better cell signal (I was inside a Leed-certified building, which is terribly inefficient at transmitting cellular signals), but eventually the Play Store loaded correctly. Odd, because everything else that uses data was working fine. I eventually re-enabled my modules, and it still seems to be OK.

Help - I tried to do the Play Integrity Fix, and now my Play Store is broken... I just see a cartoon satellite with "try again"

Here's what I did... any help would be much appreciated!

I downloaded and installed Play Integrity Fix v15.4 in Magisk 26.4

I found a dump for an obscure device and created a pif.json file, I put it in root/data/adb

I wiped data for Google Services framework, play store, & play services

I disabled Shamiko & MagiskHide Props Config

Zygisk is ON

Enforce DenyList is OFF

Rebooted the device several times
[General Topics] zgfg:
First of all test do you pass Basic and Device Integrity

If not using Shamiko, DenyList must be Enfirced (but you may need Shamiko and only in that case you disable DenyList)

Etc - check eg in the PIF thread for details...
[General Topics] adinechin:
From my point of view you should not disable Shamiko
[General Topics] DrPhant0m:
Well, I didn't know yet at the time, because I was opening the Play Store to download the Integrity test app.

Now that I got the Play Store working (see my updated post), I do NOT pass all three:

Device: FAIL

Basic: PASS

Strong: FAIL

(BTW... I passed both Basic and CTS in YASNAC before trying the Play Integrity Fix... but it fails CTS now. That may not matter much soon, though...)

For what it's worth... I'm on an S22 Ultra (SM-S908E, Int'l Snapdragon, unlocked BL) running DrKetan ROM vT11, which is NOT encrypted. I presume that this has a lot to do with my failures. I plan on wiping my phone soon and installing a stock-based ROM with root to try to poise myself better to pass.

I eventually re-enabled my modules. The reason I disabled them was because when I installed the Play Integrity Fix, it mentioned disabling the modules. I only disabled them after I realized the Play Store wasn't loading.
[General Topics] zgfg:
Basic and Device are mandatory to pass.

You don't need to bother with YASNAC and SN/CTS, concentrate only on Play Integrity

You have to find the working prints you will use for your pif json file (if using PIF module).

In the PIF thread there are posts and links for alternative modules that still provide the pif json with spoofed prints - in that case you don't need to mine for your own prints

However, there could be other reasons like Permissive SELinux forced by your custom ROM

Also, Google recently started to chase for custom kernels.

In the PIF module you can find more info about (I really WON'T' ANSWER further about) - users who up to recently passed Device Integrity, now started to fail and they either had to return to stock kernels or use specific additional methods to spoof their custom kernels

If all that looks too complicated (it is becoming more and more, expect that Google will introduce even more stringent checks), users should switch back to stock ROMs (stock recoveries, kernels, etc), uninstall root and lock back the Bootloaders - then PlayIntegrity will pass with all the three Basic, Device and Strong, 'root' checking apps will not complain, etc - that's how the 'security/integrity' is designed for
[General Topics] DrPhant0m:
Thank you for the comprehensive response!

It is getting more and more complicated... and I have less and less time to dedicate to it, unfortunately.

I am aware that this is a "General" discussion, so I've also been asking questions in my device forums. I have an International S22 Ultra (SM-S908E), and there seems to be two "stock" options emerging for me.

One method is a new/emerging method, which is kernelSU. See here: Stock Boot with KernelSU

This thread seems to assume that the users are all more educated and in-the-know than I am currently, since there isn't as much hand-holding or FAQ in the OP... and there's only 1 page of responses so far.

Since you mentioned the stock kernel... I'm curious what the thoughts are on the "kernelSU" option here.

The other method is the more traditional stock firmware method - flash full stock fw in Odin (Samsung's dev software), enable OEM unlock to unlock the BL, patch the AP in Magisk, then flash the patched file to get root.

Any commentary or suggestions for me are much-appreciated. Thanks!
[General Topics] zgfg:
The PIF module, as the first step, does support KSU. However, again, spoofing prints are needed (you must spoof your phone to pretend as an 'old' one that did not require Strong attestation on TEE - otherwise, TEE, irregardless of KSU will detect the unlocked BL and Play Integrity will fail

KSU supplements Magisk (for the root/su privileges) but like anything custom, it requires unlocked BL for flashing

KSU requires custom Kernels - since now, Google additionally checks for the kernel name and you will have to properly spoof that name, too. Probably, actively maintained KSU kernels will (soon) care about and/or the future versions of the PIF modules or its forks

No land for old man
[General Topics] thecompany:
Doesn't work on my Pixel 8 Pro as well. Keep getting the "org data removed" message because of a rooted phone. Installed PIF from here: https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v15.5, installed shamiko, configured the denylists correctly but unfortunately, Outook and Teams keep logging out.
[General Topics] Jirachilover:
Hello everyone.

Had issues with device integrity check but basic integrity check worked. Today I updated my apps (intune, teams, outlook) and had root detected.

Device pixel 6 A12 on stock.

Managed to fix the root detection as follows:

Updated magisk to latest (27000) via direct install.

Updated shamiko to 1.01 from the link that has been shared https://github.com/LSPosed/LSPosed.github.io/releases

Install latest PIF https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v15.7.2

Reboot pixel 6.

Open up Play Integrity API checker (playstore) and check.

Now MEETS_DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY is passing again and am no longer getting booted from MS apps.
[General Topics] Frost90:
Today Company Portal suddenly started detecting root after 4-5 months of working great. I was using Magisk Delta version 25 to hide it up until now. Tried Magisk Kitsune 27 and Magisk 27+Shamiko to hide it, however no success. Temporary solution was to delete Magisk and unroot (sadface). Anyone else experiencing the same and any solutions?
[General Topics] zgfg:
First of all you had to test Play Integrity and if necessary update PIF module or your custom JSON

Second, if you have custom Kernel and/or custom ROM, to check by uname -r to find how your kernel identifies and (you have to compare vs the posts in PIF thread) if yourcustom Kernel is banned

As said above, first od all you need to pass Play Integrity. There is a separate thread for the PIF module with the best up-to-date info, instructions, tooks, etc

I doubt, anybody would be willing to write novels here and update them every day or week when something changes related to Play Integrity (bamned prints, banned kernel names, new versions for the PIF or related modules, new tooks to mine prints, Magisk, Shamiko and related issues with PI, etc)
[General Topics] Frost90:
I had Play Integrity Fix before as well and fingerprint was working fine, Google Wallet was still working while Company Portal was the only one which started to detect root.

I don't have custom kernel, I do have custom ROM.

I tried with latest Play Integrity Fix, Shamiko, Magisk, Kitsune and pass Device Integrity and Basic Integrity, however Company Portal still detects root.

Having unrooted the phone Device Integrity fails however all apps work: Banking, Google Wallet, Company Portal,etc. LE: Google Wallet started to fail, most likely because Device Integrity fails.