yashsingh1/xdaforums huggingface dataset:
[General Topics] R56:
Some observations from a work profile user that can't downgrade MS versions. Nothing is consistently working but I can share MS version numbers if it's helpful.

Magisk Canary, d4e552d0 (26301).

Shamiko v0.7.3 (174) + USNF v2.4.0-MOD_2.0.

Zygisk on, Enforce DenyList off.

Configure DenyList = select all MS + Work Setup + Authenticator + GSF, etc.

Systemless Hosts + MagiskHide Props Config if that matters.

What I've noticed on work profile:

Just like everyone else, all of a sudden started failing compliance checks. Company portal is fine, apps do not work. I have not tried Alpha but have otherwise tried the usual steps of clearing data, uninstall / reinstall, etc.

Widgets continued to work -- calendar and inbox widgets display the list of items. If I click on any item the app will open and compliance check fails.

Notifications continued to work -- calendar and inbox notifications are displayed but clicking on them opens the app and compliance check fails.

If Company Portal is not in deny list the widgets and notifications stop working. Company Portal always passes the compliance check if it is in the deny list. At one point I forgot to include it in the deny list and the portal compliance check failed. It was fine after adding back to the deny list, no reboot.

Teams Notifications *and* notification replies continued to work -- whenever I was able to get a Teams message notification, if I click reply from the notification it works fine. I cannot click on the notification to open the app because the compliance check will fail.

Sometimes Teams will work, Outlook never worked -- when replying to a Teams message in the notification I accidentally clicked it and Teams opened. The compliance check was successful for some reason and when I clicked Continue, Teams opened and was fully functional. I checked Outlook and it failed, and then went back to Teams and it failed the compliance check.

No clue why Teams would sometimes work (only has happened twice).

As long as Company Portal passes the compliance check and I do the initial login for Outlook, the widgets work even though the app will not successfully open. Data is being received by the widget and notifications even though I cannot open the corresponding apps. If the Company Portal does not pass the compliance check, data is no longer received by the widgets and they do not update.
[General Topics] ykjae:
@R56 with the lsposed mod called "let me downgrade" I was able to downgrade the apps without a problem. This way they never uninstalled just "updated" You are able to install a app version smaller then the current installed package. Of course then to prevent auto update youd wanna use zygist-detach or turn off auto updates.

Also if you disable to many trackers the apps don't respond so don't play with that setting to much. And check the app ops again - sometimes they revert to deny which will also prevent the apps from opening. Once everything is working correctly take a backup of the apps in app manager.

I've messed around in the "shared prefs" screen also and disabled root checks but I'm not sure that's a working factor.
[General Topics] adinechin:
For your information, on my side, I scratched everything and reinstalled this way:

Using Magisk 26.3

Zygisk activated

Magisk hidden

Modules

Shamiko v0.7.3 (174)

Universal SafetyNet Fix v2.4.0

All work apps checked in deny list :

Edge

Outlook

Company Portal

Teams

To Do

I installed the advised version of Intune Company Portal (5.0.5926.0), and blocked the update of this package only.

The result is :

Outlook outside of Work Profile is working fine (with my calendar synchronization)

The work profile has been correctly initialized

I also blocked the update of the Company Portal in work profile (which stayed in the same version)

I installed all my apps via Play Store in work profile

Everything is working fine

I even had a ROM update which removed Magisk, and all is ok after reflashing Magisk

Hope it helps you !
[General Topics] ykjae:
A work profile wasn't created with my installation of company portal; it seems there are 2 different ways company portal installs
[General Topics] adinechin:
Here is what I do :

Install Company Portal APK

Install Outlook (I did it via APK but perhaps Play Store also works at init)

The following steps are because I connect outside of Work Profile to have my work agenda merged with my personal one

open Outlook

Connect to my account

Here Company Portal is used to register my device

Open the Company Portal app

Login to my account in the Company Portal

The Work Profile creation is proposed here, and I continue the steps until the end

I can then install apps in my Work Profile with the dedicated Play Store

Little question while we are talking Work Profile : do you still have the "Work Profile" tile or not ? It seems that it does not appear anymore, and I cannot add it either...
[General Topics] R56:
thanks @ykjae , I hadn't look at the lsposed mod but I'll give it a try with my work profile setup.

@adinechin I'm still seeing the tile "Work apps".
[General Topics] DJionut123:
Hi guys

Still stuck on this. I uninstalled everything, and only re-installed teams. Logging into teams I can enter username password (instead of MFA) and i get to the last step before it asks me to install Company portal. I manually install 5926 and don't open it, then re-try teams. white screen freeze, a few clear caches later it launches with an error "There was an issue launching your app. Try updating hte app or the MS Intune C.P app.."

Also tried the app manager, disabling the receivers / services / activity, either I'm not doing it right or it had 0 effect.

Surely there must be an easier way to fix this? 3 weeks now w/o work apps on my phone, I'm seriously considering removing root. I'd miss adaway and YT revanced, but still, it's way too annoying not to have my work apps available.
[General Topics] swieder711:
Is App Manager working for anyone on Android 14? I get a flickering screen and than the app crashe.

Everything was working fine with Android 13. Tonight I upgraded my Pixel 7 Pro to Android 14 and now root is being detected by the downgraded version of Intune portal. I even removed Magisk and Intune is still saying the my device is non-compliant. Correction: Outlook runs with Magisk uninstalled.

Is anyone running A14 and able to hide root from Intune?
[General Topics] Dev-iL:
A13 here... Which versions of Magisk and AppManager are/were you using? Stable or latest alpha/canary?

According to AppManager's changelog, A14 crashes were supposed to be fixed on v3.1.2. There's also the bleeding edge 4.0.0a2 which you could try. Either way, if none of these work for you, you might want to look at the existing issues on GitHub and possibly creating your own.
[General Topics] xXfreshXx:
ReVanced does not need root (with microg). And you can replace adaway with self hosted pihole/adguard.
[General Topics] vMAC:
Yes I just did the upgrade and mine still works.
[General Topics] swieder711:
Thanks. That gives me hope that I am just missing something.

Does Intune say that your device is non-compliant? Did you run Intune or just go straight to an app like Outlook?

Are you running play store Integrity fix? That may be the next thing that I try? Same for App manager.

@vMAC - What version of App manager are you running with A14?

UPDATE: All of my corp apps including Outlook, Teams, OneNote and Slack are working without detecting root. No sure what changed. I started from scratch, no root, etc. Then installed each piece one-by-one. Once Outlook worked than I added the other apps. Must have missed something the first time.
[General Topics] vMAC:
Glad you got it working.

Not running any play store integrity fixes, and still using same versions as I mentioned in prior post.
[General Topics] Pbotelho:
Does anyone know how to bypass device/manufacturer checks in Intune?

My company recently banned OnePlus phones and only accepts Google and Samsung Androids now.

I've tried using Android Faker to change the device ID to a Samsung device, and company portal (5926 version) sees the spoofed device ID but says that my device doesn't meet requirements.

Anyone have any tips? I was able to get root working with 5926 prior to the device ban
[General Topics] R56:
@Pbotelho have you tried to spoof a device fingerprint with MagiskHide Props Config? See https://xdaforums.com/t/module-depr...safetynet-prop-edits-and-more-v6-1-2.3789228/ and https://github.com/Magisk-Modules-R...lob/master/README.md#simulating-other-devices.

It's deprecated but for the fingerprints that are already there it works fine as far as I can tell. You'll have to use props options 1 Edit device fingerprint and 2d Force BASIC key attestation and Pick value from device list.
[General Topics] jbradshw:
I also had success with this. I just blew away all my work apps and profile and started from scratch and so far it's working.
[General Topics] vMAC:
Go to terminal app, get root, then put this in:

dumpsys device_policy

Post back what you get.
[General Topics] vMAC:
This is the phone that you have Intune (Company Portal) on?
[General Topics] Pbotelho:
Yes it is
[General Topics] vMAC:
Sorry I can't help.

This is the phone that you have Intune (Company Portal) on?
[General Topics] Pbotelho:
Mind telling me what the intent was?
[General Topics] swieder711:
Is there a way to tweak the Intune APK so that I does not show up in the playstore list as needing an update? I recall an app that could be use to change the signature or something like that.

It is a mild nuisance.
[General Topics] vMAC:
Has anyone updated to the new Lsposed? Wonder if this will allow us to update to newest Company Portal. I believe after 30 days company portal will stop allowing access until it is upgraded to latest version....
[General Topics] swieder711:
I read a post where someone reported problems with the latest lsposed. Im holding off on upgrading for now.

Help! AOSP/Pixel Xpert Mod messes with DPI & Screen Size; now I can't do anything

I am on a rooted stock a14 phone, running LSPosed to get AOSPmods working. I just updated to latest LSPosed version and this happend: s. attachment. Everything is so small... how can I fix this? Thank you guys!

xdaforums.com
[General Topics] R56:
@swieder711 did you ever find a solution for this?

This doesn't answer your question but I'm using Update Locker to block updates to Intune. Once I realized how to properly select the app I am seeing the behavior you are asking about -- Intune update doesn't appear in the play store.

A14 P6P with work profile btw.

https://xdaforums.com/t/mod-xposed-4-1-update-locker-stop-update-your-apps.4433253
[General Topics] swieder711:
Sweet. That worked. Thanks.
[General Topics] R56:
@swieder711 is everything still working for you? I'm on a P6P with A14 and a work profile and root was detected today after working fine the past few days. Not sure if I missed something.

I'm not using App Manager since I haven't had to before, but I'll give that a shot. I also only installed most Office apps in just my work profile, not my personal profile. The apps still showed up in Deny List, but I'm not sure if that was just because they were just selected from before.

Other than those two things, I think I covered everything everyone else has done.

Magisk Canary

Zygisk, Do Not Enforce (using Shamiko v0.7.3-174 instead)

Other modules like LSLPosed, ACC, MagiskHide Props Config

Deny List include all Office apps but I did not include Play Store because I wasn't sure if that would interfere with UpdateLocker

Intune 5.0.5926.0

Outlook 4.2338.0

Teams 1416/1.0.0.2023191501

Lens 16.0.16827.20036 (the only one also installed in my personal profile)

UpdateLocker 1.2.7

Selected Play Store and Company Portal

For apps I only selected Company Portal

I followed what others have done, removed Office apps and work profile and started from scratch. Worked fine for a couple of days. Not aware of anything special I did between the last time it was working and the time I noticed it detecting root this morning.
[General Topics] swieder711:
Everything is working for me on two devices with A14. Double check your deny list in Magisk. I triggered root detection a few times by missing some checkmarks on the list.
[General Topics] R56:
Thanks, everything is working after a reinstall. As far as I can tell what made the difference was taking Play Store and / or Play Services off the deny list.

What threw me off was everything was working for about a day after I took those off the deny list.
[General Topics] supermansaga:
Can anyone still experiencing problems upgrade to Magisk canary 26302 and see if the problem persists?
[General Topics] R56:
Everything seems to be working on Magisk Canary 26302 and Intune 5.0.6032.0. A14 on P6P.

Confirmed Outlook and Teams working.

Upgraded from Magisk Canary 26301 to 26302. Rebooted.

Confirmed Outlook and Teams working.

Removed Intune from Update Locker.

Upgraded Intune to 5.0.6032.0 (636136).

Cleared cache for Outlook and Teams.

Confirmed Outlook and Teams working.

Rebooted.

Confirmed Outlook and Teams working.
[General Topics] swieder711:
Is 6032 the latest version of Intune? Surprised to hear that it doesn't trip root detection. That is great.
[General Topics] supermansaga:
It is the latest. Released on 10/13. Hopefully more good news from other brave souls. I am fed up with the earlier detection.
[General Topics] antoinecimino:
Hi,

On my side, I updated the OxygenOS to 13.1 yesterday. I have also updated Magisk to 26302.

The Intune (5.0.6032.0) Company Portal has detected root (either this or one of the MS Office apps). Surprinsingly, it has worked for me yesterday after playing with the DenyList options (only .omadm_client_process part of the DenyList for Company Portal and all MS Office apps, Teams, Outlook, Sharepoint, ... were ticked as well).

During my trial and error time post upgrade, I have realised that if all options were ticked for Intune, the app would not launch (stuck at launch screen) and if one of the MS Office app gets shut down, it would not re-open either.

Today for no reason I got some root rejection error message (MS Teams and Outlook). I have tried to reinstall the Work Profile but I have faced the following issues

if I install the Intune app and set-up the work profile, without adding any of the Intune options to the DenyList, MS Office apps will not launch (root error message) even though each one of them is part of the DenyList

if I install the Intune app and quickly add it to the Deny List, I get an error message stating that the work profile cannot be set-up

Any idea to bypass the root checks ?

OnePlus NE2215
[General Topics] R56:
I'm on Android 14, Pixel 6 Pro, Magisk Zygisk Shamiko, with a work profile. For now I have everything working with Intune 6032 but I did run into some issues with both 6032 and 5926. Sharing my mistakes in case it helps any.

I tried to avoid uninstalling all MS apps and the work profile because I didn't want to go through that effort. It sounds like you have done this already.

At some point on 5926 I had taken Play Store and Play Services off of the deny list. Everything had worked fine for at least 24 hours and then all of a sudden stopped working. It took a comment from @swieder711 for me to realize that the root detection was tied to a change I made to the deny list, even though I didn't see the impact until well after I made the change.

When I worked on getting Intune 6032, several times I made a mistake of opening a MS app before confirming it was on the deny list. Clearing cache wouldn't make a difference -- I had to start from scratch each time.

For the last point about starting from scratch several times, here is an example of what I did:

Uninstalled all work profile apps, then uninstalled company portal, removing work profile.

Started installing Intune 6032, started creating work profile.

There was some point during the intune / work profile setup where I opened Intune before checking it was on deny list and then it showed root detection. Short of uninstalling it completely I could not get past that step if I opened Intune and it wasn't in the deny list.

*** Edit to finish the sentence I was writing -- somehow I pressed Ctrl-Enter in the middle of a sentence.
[General Topics] antoinecimino:
Thanks for your message, I'll try again. I did not mention but all CTS and basic integrity are passed.

Also something quite strange, I get shortcuts created for ALL apps on my phone when I set up work profile... And my keyboard language changes..

I have already tried to clean the cache of Play Store and Play Services, l'll try full reinstall every time and see...
[General Topics] antoinecimino:
so far it gives me the same result, I need to tick all Intune Company Portal items but "com.microsoft. windows.....tal: omadm_client_process" in the deny list in order to set up the work profile.

Then it is impossible to register my device at Company level even though the device is compliant
[General Topics] ykjae:
I've uninstalled and reinstalled multiple times. I get outlook to load for about 3 seconds and the health check screen comes up. Everything is green but then after a pop up come In and tells me my device is rooted.

I'm on official TJW 26203 currently, I've tried delta and alpha. All with the same result.
[General Topics] R56:
Just to confirm, have you tried TJW Canary build, 26302, from https://github.com/topjohnwu/Magisk? That's working for me using Zygisk and Shamiko.
[General Topics] stu5797:
I can use some help here! I finally have outlook installed and "Working". But I have to manually sync so I don't get push notifications. I did troubleshooting on the app and it says push notifications don't work because "Google Play services are not installed." Can anyone lend me a hand here? Much appreciated!
[General Topics] stu5797:
I figured it out. I have outlook hidden in Hide my applist module (HMA) and I had the Google Play Integrity API app checker in the blacklist. Outlook didn't like that so I removed it and it worked!
[General Topics] zgfg:
Notifications for applications work through the API in Google Play Services. So be careful when playing with things

Generally, you find a thread on XDA with discussion about HMA. Particularly, the post #1 in that thread links to the Instructions on GitHub
[General Topics] ykjae:
So I've installed the latest alpha magisk with the latest shamiko while using hma and I am having no problems.
[General Topics] DrPhant0m:
Hello. I'm new to this thread.

I have a Galaxy S22 Ultra SM-S908E (international, unlocked BL). I am currently running DrKetan ROM vT11.

My employer manages Outlook and Teams via MS Intune (Company Portal), which is obviously why I'm here. 😅

I have followed the directions in this thread, and I also installed Island to create a Work profile ("Island") on my phone, to which I have installed Intune, Outlook, and Teams to try to isolate them from everything else.

Unfortunately, these apps that I want to "stay on the island" to avoid root detection only work for a short while after I reboot the phone. Eventually, root is detected and subsequent use of the apps will be halted by a "device unhealthy (root detected)" screen. (We all know that spilled ice cream screen here, right?) Restarting the phone will allow me access again.

The ROM thread has little experience/interest in helping me with this issue, so I'm hoping that I'll have more luck in this thread full of users with a common interest in making InTune work!

The ROM that I am running is decrypted, and that was brought up as a possibility as to how InTune detects root. Could this be? Would I have better luck using a stock ROM with root?

Anyone else here have a Samsung phone similar to mine? I know they're not as common among the rooting/development community due to all the US models being bootloader-locked... but I'm hoping others here may be in a similar situation.

Thank you all for any help you can offer!
[General Topics] crazi_in:
For me with the latest Intune it was working fine with Magisk Delta and UNSF.

But after I installed Kali Nethunter, Teams stopped working (health check issue) .

Now i am using the above method and its working great as of now.

Magisk Delta -- Method---

1. Install Magisk Delta debug version (Check safetynet, if it's not passed install USNF)

2. Enable configure Su List / unmount modules

3. Enable unmount modules by default

4. In configure unmount only select "application which needs root "
[General Topics] R56:
Do you have to install Island? In my case the work profile gets created by Android as I am going through the setup process for Intune. When that work profile gets created I have a separate Play store where my work apps are stored. I'm not sure if it's different on Samsung, but in my case I'm able to get everything running on a Pixel 6 Pro and an Android created work profile without Island.

The "eventually, root is detected" part is similar to what's happened to me in some cases. Maybe there is some case where root is not even checked right away?

Does your phone pass integrity checks, e.g., through Play Integrity API Checker or YASNAC? In Play Integrity API Checker I'm passing device and basic, not strong. If you're not passing any integrity checks in Island I would think you won't get Intune working properly.

In my specific case the latest version of Intune only worked when I used Magisk Canary 26302, but it looks like others have had success with Magisk Delta. The root method seems to make a difference.

If you don't want to swap out your ROM yet, have you tried using Intune Version: 5.0.5926.0 (6163266) from APK Mirror? That seems to be the last known version of Intune that works with the older root methods. If this works for you use something like Update Locker so the version doesn't get updated. I think this might only be a temporary solution since it seems unlikely that you can stay on an old Intune version indefinitely.
[General Topics] mr_fingy:
sorry, to ask this, I'm on 26300 , how do I get Magisk Canary 26302 ? I have tried changing the Update Channel without any success.

Update: I chose the Stable release when flashing with pixelflasher, is there a method of flashing to canary using the same tool?
[General Topics] R56:
Sorry, should have provided more information. A bit off topic from Intune, but I'll share a few things.

For now I'm not looking at any of the Magisk forks, so for the Canary build of the original Magisk I go to https://github.com/topjohnwu/Magisk#downloads. The Magisk Canary link lets you download the file app-release.apk.

Once you install that version you should see the option for the Canary update channel in the settings. In the Home screen I'm seeing my version as 0352ea2c (26302).
[General Topics] mr_fingy:
Thanks for the reply, I sussed it not long ago. I just removed existing Magisk and repatched the img using pixelflash
[General Topics] DrPhant0m:
On my SM-S908E (Samsung Galaxy S22 Ultra), running Dr Ketan ROM T11, I had to install Island... and then do some extra ADB work as instructed on the Island website, in order for the "work" profile to show up.

Installing Outlook/InTune did not force the work profile, either.

I wish I knew! It was suggested that since my current ROM is decrypted, that's something that can't be hidden and Intune can "see" during the device checks. Perhaps it takes a while for it to analyze and eventually determine that a decrypted ROM implies root access... but I definitely do not have any reliable knowledge to prove or disprove this theory.

I do consistently pass both integrity and CTS in YASNAC. My "evaluation" is BASIC, fwiw.

I might try using a different (older) version of Intune after I try a different ROM... but I'm with you that I'd rather find a different method of accessing my work email and Teams than have the rug pulled out from under me when they require a newer version that will make it stop working.

Thanks for the reply! I'm looking forward to finding the time to try out a few things... but I haven't been able to dedicate enough time to making sure that I do it all correctly. I get anxiety over trying things like this because I don't want to mess anything up, brick my phone or access, etc.