yashsingh1/xdaforums huggingface dataset:
[General Topics] WorldOfJohnboy:
Magisk = 27.0 (27000)

Modules: MagiskHide Props Config 6.1.2v137, Shamiko v1.0.1 (300), Systemless Hosts 1.0, Universal SafetyNet Fix v2.4.0

DZygisk enabled, Enforce Off. Denylist include 100% of all Microsoft applications (Teams and Outlook are the ones I need working)

I've also tried a similar fingerprint (Pixel 6 Pro specifically) and still getting the CTS Fail. This was working on a very old version of Intune Portal (want to say from fall of 2023), but recently got the message that I needed to update in order to use MS Apps.

EDIT: I installed Intune 5.0.6078.0 and Outlook Launches without issue, but Teams is still throwing the error that I need to install latest Intune version to get it working.
[General Topics] WorldOfJohnboy:
Do you have a link? I've installed, but still no dice. Safety check is now failing both CTS and Basic
[General Topics] Jirachilover:
There are only like 60 unbanned fingerprints in total left before root is beaned for good, you have to use the latest chiteroman play integrity fix for one. A random one won't work because of the sheer amount that have been banned. The hide props and universal safetynet fix modules are now outdated. You should be using the latest play integrity fix.
[General Topics] WorldOfJohnboy:
Sorry, I meant instructions for Kitsune Mask. I installed the Kitsune APK and patched init_boot, then configured but still getting the Rooted device error.

I may go back to stock boot until the next monthly update and perhaps try in a cleaner process.
[General Topics] Jirachilover:
Sorry -- I forgot to mention this: Kitsune mask didn't work for me until I enforced SuList (and I also gave the things that have been given super user access whitelist for that otherwise your other apps will just not work with root) but it can fug up some modules (some people earlier in the thread were talking about it)
[General Topics] WorldOfJohnboy:
Mine was not working until I both hid the App and enabled 2 modules that I hadn't re-enabled (I also saw earlier references to Modules messing up). The two I had to enable were Shamiko and MagiskHide Props Config. (I didn't need to change my footprint, just enable the module.) I also added the Play Integrity Fix module previously. Now in YASNAC I'm getting Basic and CTS PASS!
[General Topics] adinechin:
I would suggest:

trying Magisk Kitsune with SU enforced list (you only list processes which need root instead of masking)

I will not need Shamiko (because it's included in kitsune)

I think Universal SafetyNet Fix is obsolete, you need to use PlayIntegrityFix : https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v15.9.9
[General Topics] WorldOfJohnboy:
Yes, I switched to Kitsune and everything worked. I also like the fact that I can whitelist apps that need SU rather than trying to blacklist SU from a large number of apps. The process to root in the OP is identical, the only real change is to use the Kitsune Magisk App/Zip.
[General Topics] swieder711:
Thanks for the write up. Two issues came up for me. I used the Debug version of Kitsune. Had to enable "Enforce SuList" and add those apps needing root to the Su list.
[General Topics] Steve0007:
For those using Lposed and who can't stand their company restrictions like not able to install apk, there is a Lposed module to use. Install it only on your personal profile (not the professional one). It works only on Lposed
[General Topics] Jirachilover:
Wait, how did you hide lsposed and lsposed modules from intune? Even hide my applist doesn't seem to help me
[General Topics] Steve0007:
I don't think Intune detects Lposed. HMA was not working for me.

Let me share my Lposed and Kitsune/Magisk modules
[General Topics] fameowner:
I had similar problem with outlook and microsoft teams. I tried different advices, here what worked for me:

1) Disable all modules

2) Install Magisk kitsune

3) Install PlayIntegrityFIx https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v15.9.9

4) Install Lposed https://github.com/LSPosed/LSPosed/releases

5) If you previously used MagiskHide Props Config or Shamiko - done use them they dont need in current configuration

6) Enable Zygisk and MagiskHide swithcers

Here is video example:
[General Topics] mancman:
Hello @ all.

Banking apps etc all is working, but MS company portal, detected root and all my MS stopped working.

This worked for me coming from Magisk 27.xxx and Zygisk - LSPosed / Shamiko / Play Integrity Fix v15.9.9 / Magisk Bootloop Protector

I downloaded the debug version from Kitsune:

Releases · HuskyDG/magisk-files

Contribute to HuskyDG/magisk-files development by creating an account on GitHub.

github.com

Unhide my Magisk app

Renamed the file to debug.zip and installed it under Modules in Magisk.

Reboot

Deinstalled Magisk app

Open Kitsune and enable Magisk Hide, which makes it possible to enable SU enforced list

disabled Shamiko cause it is not needed anymore

Reboot

Added the apps that need SU to the list

NOW COMES THE IMPORTANT BIT:

Hide KITSUNE, having a different name does not mean it is not detected.

Clear cache and data from Outlook and Company Portal app

Reboot

and all banking apps and integrity check as good as before AND finally MS apps are working again

Hope this helps.
[General Topics] adinechin:
Just a little addition on my side : it was not needed on Microsoft apps, but for one app (Doctolib), I had to check "Enforce SuList"
[General Topics] TwinAdk:
Hi mancman

(and anyone else who can contribute tips, advice or troubleshooting 🙏)

First off, thank you for a clear guide on how to jump from Magisk to Kitsune; I've needed this for a while, since I can see that defeating root detection in the Company Portal, is not happening with "classic Magisk" 😅However, I am still not there yet, despite your fine guide, I just followed it, but Teams and Outlook still detects root on my OnePlus 12.

I came from a Magisk Canary setup, with all my banking apps working, as well as Netflix & HBO.

The only thing missing, is Teams and Outlook, due to Mobile Device Management policies not allowing root😒

Banking and streaming is still working, after switching to Kitsune, following your guide, but Teams & Outlook is still not working.

- I did hide KitSune

- I did enable/enforce MagiskHide and SuList

- I did clear data & cache from Outlook, Teams, Company Portal, Google Play Store and Google Play Services

- My Company Portal version is 5.0.6271.0, Teams is "1416/1.0.0.2024113110 (2024113195)

My status regarding root detection, after your guide

Using RuRu to see exactly what root is detected, I am constantly seeing HideMyApps as the only culprit (though I have many root apps that were hidden by HideMyApps). Going into HideMyApps, and hiding HideMyApps, would give me a clean sheet in Ruru, no root detected. But minutes later, HideMyApps would pop up again, ruining my clean sheet.

I then uninstalled HideMyApps, and now RuRu says that Spoofed Bootloader is detected (LSPosed Module), and it says that Kitsune is detected in the "Magisk App" category - but I have hidden Kitsune via settings (calling the app KM).

Relevant Kitsune/Magisk modules that I have loaded:

- To fix Play Integrity:

-- Play Integrity Fix, version 16.4 by Chiteroman

-- Playcurl 10.8 by daboynb

- Zygisk stuff

-- Zygisk LSPosed, version 1.9.2 (7024)

-- Zygisk Assistant version 2.1.1

-- Zygisk Detatch

Apart from that, I have the LSPosed module "BootloaderSpoofer" installed, to spoof bootloader for Netflix & HBO.

Questions:

- Can you verify what RuRu tells you?

- You say that the "important bit" is to hide Kitsune, and that a different name is not enough. HOW am I supposed to hide Kitsune, more than already done via settings?

Kind Regards

TwinAdk
[General Topics] snoopsean88:
This thread is amazing. I was on magisk 27.0 (no modules) and the latest teams 1416/1.0.0.2024113110 and intunr 5.0.6271.0. Android 9 motorola g7 power. Nothing was working but here is the fix

Move to magisk kitsune (I won't rehash this)

Enable zygisk, magisk hide, and enforce sulist

Reboot

Go into kitsune and "hide the magisk app". Name for the app for me was settingsui2

No go into "configure sulist" and only select the apps that should have root. So I originally added teams and intune here, but thats the old way. The new way is to only allow the apps that actually need root. I think it selects some apps by default

Reboot and try teams you should be good
[General Topics] TwinAdk:
This seems REALLY straight forward, but I'm not sure it will work for me, I'll give you the benefit of the doubt though 😜😅

Kind Regards

TwinAdk
[General Topics] BrotherAlameen1:
Thanks for this tutorial. This is perfect for configure BYOD and End Point Detection and Response in a workplace for an Android Device.
[General Topics] TwinAdk:
Sadly this doesn't work for me, I still get flagged and told my device isn't healthy 😔
[General Topics] moltyhero:
Doesn't work for me as well
[General Topics] Steve0007:
Latest kitsune (R6687BB53) still works & root still not detectable from Intune/Outlook work profile
[General Topics] xeliya4518:
i had R65C33E4F-kitsune (27001) and today it stopped working in work profile. should i try to update?
[General Topics] jbradshw:
Sigh.. and I wake up and discovered the work play store forced the update of Intune. I don't think we're gonna win this one for now.
[General Topics] sigfy01:
No issue for the moment. Auto update checkbox in the Play Store is unchecked and I added the name of the package to the list of app to be detached from the store by the Detach3 module.

It worked well to prevent YouTube updates so I figured it would also help here, at least until MS forces the update to continue using the app.

More info on the Detach3 module here: https://xdaforums.com/t/module-detach3-detach-market-links.3447494/
[General Topics] Phat7:
How did you do the rollback? I got the apk from the Apkmirror, but when trying to install it says "App not installed". Is there another way to rollback without deleting the work profile and recreating again? Thx in advance for any tips!
[General Topics] sigfy01:
I uninstalled the app and did a full clean up before installing the old version. I don't think there's a way to do the rollback otherwise.
[General Topics] dtkent:
I fixed it (for me at least).

They've incorporated Google play protect services into Intune and MS apps.

Make sure you've got denylist, shamiko, lsposed, and the hideapplist modules installed for Magisk.

Denylist the usual, but also add in Google Play services, play protect services, play store, and Google services framework. clear storage for play store and services (the work profile copies too if you have one) and reboot.

I further siloed things by adding MS apps to hideapplist and whitelisting them to only see each other.

It's been working for me this far today.
[General Topics] jbradshw:
Oddly enough, every since I posted my last message, it just started working again. I'll add those extra things to the deny list.

Can you explain what the difference between whitelist and blacklist do when you hide an app? I'm just assuming blacklist means hide from all and whitelist means hide from all except anything on whitelist?
[General Topics] dotHash:
stopped working for me. once i create my work profile and install microsoft teams it tells me my organization has been removed. i have Teams/Company Portal both checked completely in Configure Denylist

Edit: Unchecking and rechecking the Teams/Company Portal seems to be working for now. I got into Teams this time for now.

Edit2: It detected root and stopped working again :(
[General Topics] ywlke:
adb install -r -d path/to/apk

or using root terminal on device, pm install -r -d path/to/apk (might need to move from Downloads directory to /data/local first)

One of those flags allows downgrade to go through.
[General Topics] dtkent:
Sorry, realizing now I should've been more clear. It's been trial and error and a very fragile process. I've only been able to get Outlook to work, adding other MS apps has been flipping some other trigger I haven't found yet.

I'm creating a whitelist and giving Outlook access to company portal, MS authenticator, and the play protect services that it seems to need to avoid triggering root detection. If I block file detection or map scanning it seems to crash the app, and any wider access seems to detect root somewhere. See attached.
[General Topics] jbradshw:
When I whitelisted Outlook with those options, I got a notification that my company removed my outlook data because it no longer detected InTune on my phone. I just unhid Outlook all together to get it back working again.

What a fickle mess this all is lol....
[General Topics] alberto88a:
Hello, I can confirm that the newest version of MSFT Intune (Company Portal) breaks something. All other apps pass SafetyNet check and Device integrity check (I also changed fingerprints).

Anyway with the latest version Teams and other MS apps keeps telling the device is rooted. I'm not sure what they use to verify it (and I'd love to know it) but to solve I had to:

- Uninstall MSFT Intune

- Download the previous version from APK Mirror (as suggested earlier) v. 5.0.5541.0

- Detach it from PlayStore using the Magisk Detach module v5.3.

------ Following the instructions here https://github.com/Magisk-Modules-Repo/Detach I copied the Detach.txt in my root /sdcard/ and added this line in the end: com.microsoft.windowsintune.companyportal

After doing this it's just a matter of installing the magisk module and it will detach the app from Play Store.

Hope it helps :)

EDIT: It seems that after a while the apps appears again in the Play Store looking for update so the Detach v5.3 did not do its job :S
[General Topics] James wick:
Download the ZIP and install it as a module in Magisk (24.1 or higher). - Reboot again and restart the YASNAC - Yet Another SafetyNet Attestation Checker. It should now pass (at least) the Basic integration. Now your Microsoft Apps should work.

Regards,

J Wick
[General Topics] GoodSoul:
Upgrading from Magisk 24.3 to Magisk 25.1 solved my issue with Microsoft Teams (Intune). also, I've added ALL Microsoft and Google products to my DenyList.

Looking at the Changelog the following changes might have helped to get my MSTS running again.

So, try updating your Magisk and set all MS/G products to your denylist.
[General Topics] alberto88a:
Why google products?
[General Topics] joegreat:
I tried all the suggestions from this thread (and links), but nothing works with the updated Intune/Outlook/Teams!

I found something strange in Magisk 25.1, which might be related to the non-working:

Some applications in the deny list are NOT sticky - means they are unselected after reboot or even after some time without reboot. The found applications are:

- Google Services Framework (com.google.android.gsf) - could be the culprit!?

- Android Auto (com.google.android.projection.gearhead)

- Drive (com.google.android.apps.docs)

- ...other ones... (which I forgot)

Any idea why this applications are NOT sticky in the deny list?

By the way: Microsoft's "Authenticator" is not found by searching "microsoft" - but you have to search for "azure" to find it...
[General Topics] dtkent:
Yes, my prior technique also proved too fragile to maintain. Something interesting is that Outlook would work for a period of time after unfreezing my work apps, but then would eventually detect root and shut down the app in a delayed fashion.

I've tried blocking every root/Google app possible in Denylist, and blacklisting root/google apps in HMA, but it still detects :(
[General Topics] Searinox_Navras:
Can confirm that after struggling with all of the above for 3 hours, nothing is sticking. Magisk 25.1 + LSPosed 1.8.3 + HideMyAppList + Shamiko 0.5.1 on LOS 19.1. I get at most a few minutes of use after stopping InTune + Teams and deleting all storage then logging back in before it stops working again.
[General Topics] dkannegi:
I suspect I broke Verity/secure boot (had issues) with the universal TWRP patch Disable_Dm-Verity_ForceEncrypt and a format Data with TWRP (was having a separate issue with Magisk v25100) and a format Data from TWRP. (Booting a a magisk free loader after this still brought out the red flag).

What seems to work: Got InTune/Company Portal with Teams going with Magisk 25.1 (v25100) and secure boot Android 11. Did a combo of putting in LSPosed (Zygisk version, v1.8.3 (6552)), Shimako (0.5.1 (115)), Universal Safety net fix v2.2.1. Disabled enforce deny list (so Shimako kicks in blacklist mode, which is its default) and re-toggled ALL 'Microsoft' apps in the deny list config (Shimako uses it also). The way I always have my deny list is if the app doesn't need root, it gets everything denied. I suspect Magisk 'forgets' the settings, a re-toggle may work with the stock enforcement module vs the LSPosed/Shimako combo, but my setup has worked across multiple reboots and a TWRP backup session thrown in the mix so I am not removing the combo of modules yet.

What I didn't need to do: I didn't remove accounts. I did not delete any app data (including Company Portal). I didn't swap bootloaders this time around (yes this sometimes caused a no boot until I formatted data - I had backups).

Observations: Blocking Company Portal/InTune from the phone's LAN (but allowed non-local address Wifi and mobile data) using AFWall+ yielded interesting results before above working modules were loaded into my Magisk setup. Certain things wouldn't load up in the apps, but the apps would run/work enough and I wouldn't get the rooted phone warning - once logged in sufficiently I could unrestrict Company Portal in AFWall+ and continue about my business. This leads me to believe Company Portal/InTune is using localhost TCP/UDP connections with the apps, and also there could be a method it uses with how it interacts with the TCP/IP stack in detecting root also.

Edit 2: Got lockouts with using Zygist's Enforce Deny list, whereas with Shimako the lockouts were easily dealt with - before I fixed verity from enforcing. Also, the root method for my phone in another XDA thread only partially disables verity (by hexxing out VBMeta) - TWRP was showing verity still enforcing. I re-flashed all my stock VBmetas with "fastboot --disable-verity --disable-verification flash vbmeta_a vbmeta.img". Running avbctl get-verity in TWRP's shell verified I disabled that. Auto-patches for verity do not work on my phone. Disabling Verity and running Shimako seems to be my winning ticket. Time will tell.
[General Topics] dkannegi:
Yes- don't do this unless you have a tested backup and can restore from a soft brick state. I was doing this as testing to see how Portal/InTune behave.
[General Topics] pedritopl:
I can confirm what was mentioned earlier - that downgrading the Intune Company Portal and disabling the automatic updates in Play Store seems to be a functioning workaround.

Download the Intune version 5.0.5541.0 from apkmirror, copy it to /data/local/tmp and run (from root console) something like:

# pm install -d -r --user 11 /data/local/tmp/com.microsoft.windowsintune.companyportal_5.0.5541.0-5441097_minAPI26(arm64-v8a,armeabi-v7a)(nodpi)_apkmirror.com.apk

Note the "--user 11" part. It might be different or not necessary at all depending on the setup. In my case the company apps run in Work Profile and 11 is the ID of the Work Profile user.
[General Topics] dtkent:
I can second that this is the way. Apps are all working and stable for now, no HMA required. All my MS apps are under shamiko's denylist.

It does indeed seem to be directly related to the company portal app although, oddly, I rarely had issues with company portal rejecting my whole phone and instead the respective MS app detecting it as not healthy.

If it's of any use/interest to others, watching the debug logs from HMA, a relevant MS app always shut down right after issuing a command for "start register hooks com.microsoft.intunecompanyportal". Not sure if that's relevant or not.

Will be interesting to see if this gets sorted out as it seems like a new way to detect root not covered in the other detection methods.
[General Topics] dohanin:
company portal is called upon when other ms apps are in use. it's always in the background and pass information to other ms apps.
[General Topics] Dvojnik:
Yesterday my phone updated the Intune company app, even when I had turned off the auto update and used Detach3 module. Is there any reliable way to stop this from happening??
[General Topics] dkannegi:
Check your verity status by running avbctl get-verity from a root shell. If you have TWRP, do it from its shell. Also, once Magisk is setup, power cycle your device (not reboot), and then run up your M$ work apps. Once I did this everything behaves with zero messing around.

Results should be as follows:

:/ # avbctl get-verity

verity is disabled.

:/ # avbctl get-verification

verification is disabled.

If verity is enabled, you wil need to kill it by re-flashing all VBMeta types to their respective partitions using fastboot with flags: '--disable-verity' and '--disable-verification'; flashing both A and B splits if applicable (test your active one first):

ex (My device has A & B splits, but doesn't use B):

fastboot --disable-verity --disable-verification flash vbmeta_a vbmeta.img

fastboot --disable-verity --disable-verification flash vbmeta_system_a vbmeta_system.img

fastboot flash --disable-verity --disable-verification vbmeta_vendor_a vbmeta_vendor.img

On my phone, being rooted with verity active is playing with fire with Magisk 25.1 and these M$ apps. Seems something eventually trips verity (usually after a rooted phone warning) and I am then faced the M$ apps locking out, and usually a hung boot on the next power cycle requiring a data format and re-flash from a backup. I suspect the hung boot was the deny list enforcement conflicting - Shimako didn't do this.
[General Topics] ywlke:
"--user 11" shouldn't be necessary - and might also be different depending on how many times you've tried to reconfigure Work Profile. The phone will only keep one version of the app on the phone and it gets cloned across profiles. Make sure you disable automatic updates in both the global and work Play Stores.
[General Topics] dtkent:
Yes, my point is that company portal reports that everything is fine (even if I REcheck within the app for compliance), it is the other MS apps that are shutting out due to root detection. Company portal rechecks after root detection still come up clean. Even if MS apps hook through company portal, it's strange that company portal itself is not reporting issues inside the app, just the individual MS apps.

I had the same issue as Dvojnik. Despite disconnecting company portal from the play store and turning off auto-updates the app still updated after a forced downgrade. Everything continued to work fine until I tested a reboot and now the MS apps are again shutting down...

Work profile doesn't allow disabling autoupdate.

Edit: rather, company portal isn't available in the work play store at all. Other MS apps could be blocked from update, but company portal is only available in the main profile play store. Still doesn't affect it auto-updating, even if disabled.
[General Topics] ywlke:
Mine shows up in the work App Store as "Intune Company Portal". Maybe different orgs have it configured differently so yours doesn't show up there.
[General Topics] rahulcasper:
Sorry if I use vague terminologies because I'm still a noob but I think company portal instead from the play store, itself is searching for updates and is getting updated. Like everyone else I've disabled auto update as well and I fully trust detach modules to work aswell. I'm pretty sure company portal just updates itself without asking any permission since mfkr is a forced admin app. Any way to track what addresses are being used by company portal so that we can see when it pulls something big that address might point to the server hosting updates and just block it all together?