yashsingh1/xdaforums huggingface dataset:
[General Topics] Dev-iL:
Note that this procedure is intended (mainly) for Teams. I'll update the instructions to make this point clearer.

I, too, couldn't get outlook to work using this method, but I believe it's a matter of more trial and error. The main issue with outlook is it requires device admin rights, I don't know how to overcome that...

P.S.

As I mentioned in an earlier post, the workaround for outlook is using the outlook lite app, which works out-of-the-box on rooted phones.
[General Topics] dtkent:
Unfortunately outlook lite is not an option for me. I have to use an MAM managed Work Profile on my phone and my employer only has a select few MS apps available in the work profile app store. Outlook lite is not one of them.
[General Topics] digger16309:
Looks very powerful and something I won't use unless I have to. This is great though for a Plan B in case Teams gets borked for me.
[General Topics] Dev-iL:
Ah this is unfortunate. Have you tried circumventing the restrictions by installing through ADB? Surely there are also other options available to a rooted user...
[General Topics] dtkent:
Doesn't matter, my work is very selective about this sort of thing and there's some sort of server auth process that goes on through the main Outlook app that I can't replicate through lite. Thanks though.
[General Topics] jcotterman:
Can confirm this is working in A13 on Pixel 7 Pro.

Zygisk process Deny list disabled and handled by Shamiko instead. I am at least able to get Outlook configured and it appears happy. Will update tomorrow if things change. Prior to Shamiko Company Portal was happy but Outlook was not. Now both seem to be.
[General Topics] silverzhao:
I used old versions and they can work in root environment:

Microsoft Intune: 5.0.5541.0

microsoft-edge-105-0-1343-50.apk

microsoft-outlook-4-2231-1.apk

microsoft-teams-1416-1-0-0-2022395202.apk

You can download the old versions from here: https://microsoft-edge.en.uptodown.com/android

In case you've already upgraded to the latest version, you can downgrade them by adb commands:

$ adb push outlook.apk /data/local/tmp

$ adb shell

$ pm list users

$ su

# pm install --user <xxx> /data/local/tmp/outlook.apk
[General Topics] Sammy612:
Getting below error when trying to perform the install step on workprofile user:

java.lang.SecurityException: Shell does not have permission to access user 10

com.android.server.am.ActivityManagerService.handleIncomingUser:11965 android.app.ActivityManager.handleIncomingUser:4030 com.android.server.pm.PackageManagerShellCommand.translateUserId:3130

at com.android.server.am.UserController.handleIncomingUser(UserController.java:2147)

at com.android.server.am.ActivityManagerService.handleIncomingUser(ActivityManagerService.java:11965)

at android.app.ActivityManager.handleIncomingUser(ActivityManager.java:4030)

at com.android.server.pm.PackageManagerShellCommand.translateUserId(PackageManagerShellCommand.java:3130)

at com.android.server.pm.PackageManagerShellCommand.doCreateSession(PackageManagerShellCommand.java:3141)

at com.android.server.pm.PackageManagerShellCommand.doRunInstall(PackageManagerShellCommand.java:1341)

at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:1303)

at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:193)

at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97)

at android.os.ShellCommand.exec(ShellCommand.java:38)

at com.android.server.pm.PackageManagerService.onShellCommand(PackageManagerService.java:24869)

at android.os.Binder.shellCommand(Binder.java:959)

at android.os.Binder.onTransact(Binder.java:843)

at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4818)

at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:8926)

at android.os.Binder.execTransactInternal(Binder.java:1206)

at android.os.Binder.execTransact(Binder.java:1164)

Can someone help on this..
[General Topics] silverzhao:
sorry, I forgot to mention that you need to run "su" before installion. Just updated my post.
[General Topics] Sammy612:
Thank you!

I was able to get it working..

Though one extra step was required :

disable the app verification during adb install from developer settings

Outlook and Teams are working fine for now.. :)
[General Topics] ldeveraux:
What am I missing? I uninstalled Intune, Teams, Outlook (I don't have edge installed on my phone). I installed the versions you listed here. I blocked everything in Magisk 25.2, rebooted, and it won't let me access anything. I'm rooted and BL unlocked on Android 12 on my S10+. If I try to login to Intune, I get "Can't create work profile." because I have a custom OS installed (I don't, it's stock, just BL unlocked. Obviously when I try to login to Outlook it says "You cannot access this right now" because it doesn't meet the criteria to access this resource.
[General Topics] uhsarp:
This worked! No matter what I did with the CURRENT versions of these app, InTune always wasn't happy. I installed these versions. I also disabled auto update on Play store to avoid accidental.

I had to keep trying a few times to get this to work.

Install the APKs (Don't open yet), Open DenyList in Magisk, add these apps (including every sub item) and then continue on with the setup in Outlook.

I did NOT need to reinstall Authenticator. That was already under DenyList and didn't cause problems.
[General Topics] silverzhao:
Can the latest version of Intune create work profile?
[General Topics] ldeveraux:
No, when I try to create a work profile in Company Portal, the message errors with "The security policy prevents the creation of a work profile because a custom OS has been installed on this device."

Again, I have the stock OS on the device, but it is bootloader unlocked and rooted obviously.
[General Topics] silverzhao:
I've no idea. Maybe you can check the installed magisk modules.
[General Topics] ldeveraux:
What should I check for? I have Shamiko installed, do I need anything specific?
[General Topics] dtkent:
You're probably failing the CTS profile match in Safetynet because you're unlocked (check with YASNAC).

Download the USNF module and try again.
[General Topics] ldeveraux:
Yasnac passed both and I already had the safetynet fix mod installed
[General Topics] dtkent:
What happens if you open a shell terminal and run 'adb shell pm list users' ?

I previously had a prior Work profile fail install but it created a zombie user profile that messed up CP being able to create another one. I had to delete the zombie through adb and then it worked.
[General Topics] ldeveraux:
So if I open a terminal on the phone, enter su, then pm list users, I did get a user listed. It's that an Intune user? How do I delete it?
[General Topics] dtkent:
Your main profile is the base user, usually 0. If there's an additional one, like user 10, that may be the zombie. Is that listed?
[General Topics] ldeveraux:
No I only have a user 0 I think.
[General Topics] WorldOfJohnboy:
I have a Pixel 7 Pro and when I installed the October update, I had to run the props commands to get it working as stated in the OP. Pixel 7 Pro was not listed, but I used Pixel 6 Pro and it worked for me.

Once the November update drops, there is a new method to get the CTS check to work, so I wanted to back out the props (currently "spoofed" as Pixel 6 Pro) and go back to the original fingerprint... any idea on how to do that?
[General Topics] sundamen:
I was optimistic because it seemed to be working but then I get this error screen
[General Topics] cwmonty:
Thank you SO much for this tip. Wow I had tried everything to get things working and was pulling my hair out. Deleting this work user profile and then redoing it somehow made it all work.
[General Topics] CharlieMHz:
Here to report that I managed to get the latest Intune and Teams from Play Store working with:

Universal SafetyNet Fix v2.3.1

Shamiko v0.5.2 (120)

Add Intune and Teams to DenyList (make sure all toggles are turned on)

Turn OFF Enforce DenyList

Reboot

Force stop / kill those apps (not sure if this is needed after a reboot, but just to be sure)

I didn't need to clear the apps' data, but you can give that a try

Hide the Magisk app in Magisk's settings

Will update this post again if this suddenly stops working.
[General Topics] foremang:
Mate, i just wanted to drop a quick note to say you're an absolute legend. Thank you a million times. This worked for me!
[General Topics] WorldOfJohnboy:
Anyone know if I flash the November monthly Full update (without wipe) for my Pixel 7 Pro if that will reset my CTS Profile?

I "spoofed" a Pixel 6 Pro (using the CTS steps in the OP) for October, but no longer need to spoof the 6 Pro. I suppose I could just try a pray it works, but confirmation ahead of time would be great.

EDIT: Never mind. I went in and reverted the Props to the original... All set.
[General Topics] Shubh3112:
Tried doing this, but teams is still detecting root. And anyway no luck with outlook.

Device - Resmi Note 5 Pro (Whyred)

Pixel Experience Plus 12.1 20220922-0411
[General Topics] CharlieMHz:
Have you tried force stopping and clearing Intune data before logging into any app?
[General Topics] Shubh3112:
I haven't, but from past experience, I can say it won't work. I saw a similar solution involving Shamiko, about 2 months ago. I tried everything with data, wiping the cache, rebooting at every single step, etc. Nothing worked. Had to roll back to an older version.
[General Topics] Shubh3112:
Hey, can you please make a small guide? I had the apks in my downloads folder, and used command prompt on windows with adb and fastboot tools, got root access for that, but wasn't able to install the apks. And where exactly are the data, local and tmp folders? I'm sorry if sounding too noob, because I am, in this regard.
[General Topics] silverzhao:
"/data/local/tmp" is a directory on Android phone, you don't need to create it, just push the apk files into that directory and install them.
[General Topics] Shubh3112:
I am doing this with command prompt on adb fastboot tools, on windows. "Push" isn't available in that.
[General Topics] Shubh3112:
I was able to do it finally. Installed the versions you told for teams, Outlook, and edge. Though 1 problem still remains. Every now and then outlook and teams detect root, and I have to clear cache, and re-verify my device on intune to get them working again, and this happens almost every hour.

Any solution to this? I am already using Shamiko.
[General Topics] silverzhao:
I just did what #1 told, and it works well. Maybe you can check it step by step again.
[General Topics] skwitko:
This worked perfectly. Thank you!
[General Topics] bizkit_120:
Thanks for sharing, may I know which rom , version and company portal version you are on?
[General Topics] bizkit_120:
😄just leave comments on play store,saying it doesn't play nice with root device. 1star
[General Topics] rwhryz:
This worked. Thank you!
[General Topics] charlessxavier:
You are a lifesaver !! Worked like a charm.

I would like to gift you with some donation, please PM me with the details.
[General Topics] CharlieMHz:
Glad it worked for you! Thanks for the donation offer but I'll decline it, maybe donate it to your local charity or something, cheers!
[General Topics] patrickdrd:
what a pain this intune is for us root lovers, I tried yesterday on two devices the above instructions, clean rom install and then these steps, it worked on neither! I even unrooted, still nothing!

on the other hand it seems to be working on a 3rd one with the same steps
[General Topics] uhsarp:
This works for me!
[General Topics] Astatin13:
I

I tried this and its worked but few minutes later Teams detecting root again. Is there any way for permanent fix?
[General Topics] CharlieMHz:
Hmm I don't really know what's the cause. In my experience, the root detection happens instantly, rather than after a few minutes.
[General Topics] Astatin13:
unfortunately i had to give up root. Then both teams and outlook working but no root :)
[General Topics] cooldude5500:
Anyone managed to get Intune/teams/outlook working with latest LineageOS? Teams throws access denied no matter what.

Edit: Magisk is hidden, Shamiko 0.6, USNF modded, enforce denylist off and all apps added to denylist, still nothing.
[General Topics] barret95:
tried original solution and the solution posted on page 12 (older versions) and still no luck. :(
[General Topics] bpham1:
I'm on LineageOS 19 GSI securized build. Gotten the old versions of company profile, Teams and Outlook to work flawlessly. It'll only be a matter of time before the old versions will cease to be able to login. I'll hold out as long as I can on this build, but will probably have to give up root in the future.
[General Topics] Kris Chen:
Try HMA(HideMyApp) and It will further hide root detection.

(Guide: https://xdaforums.com/t/hide-my-applist-a-brief-guide.4519731/)

I followed his instruction to setup HMA and got clean root detection. Then I can setup teams/outlook in my Pixel 6 pro successfully.
[General Topics] reconan1:
Thanks! with HMA now intune is OK. The problem is with the rest of the work profile apps like outlook or teams...those still don't work even though they are hidden with magisk and intune is OK. The problem is that these work profile apps are not listed, they don't appear or show up in HMA to be able to include them in the black list. Any way?
[General Topics] Kris Chen:
Well, I don't need those work file and I can use Teams and Outlook to access company resources after finishing setup.
[General Topics] nieebel:
What I did to make it work for me:

A. Install Magisk v25.2 following "MAGISK ROOT 🧙‍♂️" from https://xdaforums.com/t/s4-unified-collection-guides.4224933/

B. Follow the mentioned note to prevent root detection: https://xdaforums.com/t/detected-ro...fety-net-in-android-12.4451857/#post-87127921 - this was enough to make Banking Apps working again. For Intune/Outlook/Teams, I did those additional steps:

C. Then Following the Magisk popups to update to latest org.lsposed.manager 1.8.5 zip zygisk release from Github. Then reboot and ensure that previous steps have not been reverted.

D. Follow lsposed popups to update to latest com.tsng.hidemyapplist 3.0.6 release from Github. Then reboot and ensure that previous steps have not been reverted. Ignore the "parasitary manager" thing.

E. Install icu.nullptr.applistdetector v2.4 based on HideMyApp recommendation

F. Open AppListDetector and see a lot of X

G. Rename Magisk App via Magisk Settings. Reboot.

H. Follow this HideMyApps / Universal SafetyNet Fix guide from https://xdaforums.com/t/tutorial-ro...ake-it-work-with-magisk.4402273/post-87849687 - keep "Enforce Deny List toggled OFF". Use this AppListDetector app for testing. After this you should see ticks everywhere except for TWRP.

I. Follow those MagiskHidePropsConf-v6.1.2.zip config https://xdaforums.com/t/passing-safetynet-with-magisks-zygisk-denylist.4392941/post-86308891 (not sure if really required)

J. Deinstall Intune/Teams/Outlook and install those old versions: https://xdaforums.com/t/tutorial-ro...e-to-make-it-work-with-magisk.4402273/page-11 and then add them to Magisk (make sure all toggles are turned on) and HideMyApp. If you missed something, just delete Data of Playstore+Intune+Outlook+Teams and retry.

If anybody knows a way to get the latest Outlook/Teams working, I would highly appreciate.

My device: Samsung S4 i9505 with Optimized-LineageOS-18.1-20201215-Version1
[General Topics] foremang:
You ... you are a god amongst men! YOU FIXED MY PROBLEMS! Thank you.
[General Topics] GoodSoul:
I've updated the tutorial to make it work again (at least on my 2 phones, 1 tablet, and 2 android-VMs) :-)
[General Topics] ykjae:
@GoodSoul maybe you will have a answer to my kinda related to problem.

I'm using a device to access company's data by using intune. This has now happened twice.

If I'm spoofing location or using invisible which connects to tor/i2p or VPN my company see's. How do I hide this? I was assuming maybe app opps but I just want to be 100%. This is the email I received.
[General Topics] Binary Assault:
I may have accidentally stumbled on to a fix for this. I'm using the latest version of InTune (company policy). Do everything in the OP (no need for LSposed for this method).

If InTune has already detected root, clear cache from all Microsoft apps and force stop them. If you can't FS them, clear cache then reboot the phone.

On your normal (non-work) profile, install the Intune App (I use shelter for my work profile, so I just cloned the app in shelter). Login to the Intune app with work credentials. Open up your Microsoft apps and verify access.

Haven't fully tested this, but previously I would get flagged within a few seconds of opening any Microsoft apps.

Additionally I tried to freeze InTune on my main profile, which seemed to have worked for the time being.

I'm guessing freezing might not survive a reboot but that's a minor concern for me.
[General Topics] CharlieMHz:
You guys can give the latest Magisk Delta stable a shot. Works for me without using any modules, don't even need to hide the Magisk app. Just enable MagiskHide and check Microsoft apps in the hidelist. Make sure to check all boxes for Intune.

Poco F3 | crDroid 8.9 - 2022-09-13

Intune Version 5.0.5736.0

Teams Version 1416/1.0.0.2022434101
[General Topics] Binary Assault:
Update - the method I posted is still functional with the latest in-tune. In my case, it seems that Magisk is a little sketchy with deny/hide in work profiles.
[General Topics] teddysx3:
I tried everything, and finally worked!!! I have forgot to install Shamiko, this did it for me.
[General Topics] nri_tech1183:
You mean LSposed also not required nor safetynet-fix or Shamiko ?
[General Topics] nri_tech1183:
Not at all working!
[General Topics] CharlieMHz:
Nope, just Magisk Delta itself is enough
[General Topics] nri_tech1183:
SO just have to flash Delta Canary right?

Then do we need to install any modules like safetynetfix?

Or just enable Intunue/Outlok/Teams in Denylist or also do it for Playstore/services?
[General Topics] CharlieMHz:
From what I remember, only Delta is enough. Not sure if I had SafetyNetFix installed back then, if it doesn't work without, then you can try installing SafetyNetFix. I used the modded 2.3.1 from Displax, not sure if that's needed or the regular SafetyNetFix will do.

Only add Microsoft apps into denylist, no need to add Google apps.
[General Topics] nri_tech1183:
How long ago did you tried it?
[General Topics] CharlieMHz:
Last month. If you already have Magisk, I'd recommend:

Uninstalling all Magisk modules

Install Delta app

Install Delta's Magisk using the "Direct Install (Recommended)" option

Reboot

Uninstall original Magisk app

Try installing other modules like SafetyNetFix if it still doesn't work

You can always switch back to original Magisk by repeating the steps but using the original Magisk app.
[General Topics] eustilou:
It's working, but for me Outlook and Teams are unusably slow.

15-60 sec to start outlook

30 sec to start teams

Once started, the apps take 5-10 seconds to respond to any taps.

I'm on standard magisk with shamiko.

Anyone else seeing major lag?
[General Topics] jukyO:
@nri_tech1183

Did it ~ week ago per instructions, works as a charm. OnePlius 6t with latest Jaguar ROM.
[General Topics] ldeveraux:
I've tried everything in this thread, I still cannot create a profile in Company Portal because it detects a custom OS. Do I need to use an older version of Intune and Outlook? I've uninstalled Magisk and installed Delta. Any help appreciated.
[General Topics] jukyO:
You need to follow OP to the point.
[General Topics] ldeveraux:
*sigh*, yes I've done that. It doesn't work. Can anyone confirm working on a Galaxy S10?
[General Topics] CharlieMHz:
Have you installed USNF?
[General Topics] ldeveraux:
Yes
[General Topics] CharlieMHz:
Which version? I'm using 2.3.1 MOD by Displax
[General Topics] ldeveraux:
I tried that, then there was an update to 2.4. Neither worked
[General Topics] CharlieMHz:
Play Integrity API Checker - Apps on Google Play

Get info about your Device Integrity through the Play Intergrity API

play.google.com

Does your device pass the first 2 checks? And can I see your MagiskHide list?
[General Topics] ldeveraux:
It passes Basic Integrity and CTS Profile Match. All 6 of my installed M$ products (Company Portal, Excel, Powerpoint, Word, Outlook, Teams) are all completely hidden, expanded in MagiskHide, and full blocked. When I clear data on Company Portal and try to setup a work profile, it says "The security policy prevents the creation of a work profile because a custom OS has been installed on this device."

EDIT: sorry, didn't see the API Checker, I ran it and it passes the first 2, fails the strong integrity
[General Topics] CharlieMHz:
Just as a last thing, do your settings look like these? The Zygisk toggle isn't needed if you're not using any Zygisk modules
[General Topics] ldeveraux:
OK I disabled Zygisk

I have Company Portal 5.0.5771 and Teams 1416/1.0.0.2023012702. Do I need specifically those older versions? When I tried months ago they still didn't work.
[General Topics] CharlieMHz:
Nope, should work with the latest versions.

Also, I just went through your previous posts and realized that you're trying to set up a work profile. That's the Android work profile you're talking about right?

In that case I'm sorry I don't have experience with that, as I'm running them without a work profile.
[General Topics] ldeveraux:
I don't know honestly, I'm just trying to get Outlook on my BL unlocked phone. I think I need Intune working before I can use Outlook? When I login to Intune it tells me I need to setup a work profile, then the error. If I can do this without doing the work profile, let me know!
[General Topics] CharlieMHz:
Do you need to login to Intune to use Outlook? I'm using Teams without having to login to Intune. I only installed Intune because Teams asked for it when I logged in.
[General Topics] ldeveraux:
I assume so, when I login to my account in just Outlook, it says "You cannot access this right now" and "you did not meet the criteria to access this resource" and "you might be signing in from a resource restricted by your admin" The troubleshooting details below say there is no device identifier and the device state is unregistered
[General Topics] CharlieMHz:
Oh in that case you can probably look into ways to get a work profile working on an unlocked device. From what I've seen, Samsung devices are a pain in the butt when it comes to these things due to the tripped Knox.
[General Topics] ldeveraux:
Where should i look?
[General Topics] CharlieMHz:
Google or search in the XDA forums. Here's one I came across: https://xdaforums.com/t/guide-work-profile-alternative-for-rooted-knox-tripped.3856717/
[General Topics] ldeveraux:
I was hoping for advice, not "go google your problem". I've already googled to death, that's why I'm here. I was hoping someone might catch something I'm missing
[General Topics] skuppej:
@ldeveraux I know that some people are saying Magisk Delta is all good and stable and working, but I think it will probably need a few more months to air out these issues so that it is compatible with all devices.... Appreciate you testing this for us though and sorry it didn't work out! :\

I am doing:

Magisk Alpha Canary
Zygisk + Denylist (+ Enforce Denylist=Disabled)
MagiskHide Props Config (+ Fingerprint)
Universal SafetyNet Fix
LSposed + Shamiko + Hide My Applist

And this is still working well for the following versions:

Intune Company Portal - 2023-01-25 - v5.0.5771.0
Teams - 2023-01-22 - V1416/1.0.0.2023012702
Outlook - 2023-02-07 - 4.2302.1

(I'll update this post with new versions as I test them.)

For Teams to work I didn't need to actually sign into Company Portal nor use any work account (nope). Just clear data and open teams.
[General Topics] skuppej:
I also highly recommend that you disable auto-updating in Play Store for these apps, in case that they get patched in the future.