yashsingh1/xdaforums huggingface dataset:
[General Topics] Shubh3112:
Everything was working fine for me, when suddenly one day Intune started throwing this message -

"Your device failed a critical Google security check, also know as certified device check.

So I checked Play Integrity API Checker, and it turns out that I'm failing the Strong Integrity check.

What can I do? Any suggestions/advice?
[General Topics] ChrizZz90:
I have the same issue. Also failing the strong integrity check. @Shubh3112 did you solve it in the meantime?
[General Topics] kangaroo72:
I made the setup today. Everything is actually working.

Galaxy Note 10+ with latest Dr. Ketan ROM.

Company Portal 5.0.5771.0

MS Outlook 4.2303.2

MS Teams 1416 / 1.0.0.2023012702

To be safe, I just disabled Auto-Update for CP, Outlook & Teams
[General Topics] ChrizZz90:
I have an one version older Outlook app installed, Teams and company portal is the same.

My feeling is that Google is alerting the Microsoft apps and not Microsoft itself
[General Topics] digger16309:
I almost messed up. After updating to the latest USNF, I had to re-certify via Play Store and wiped its cache. That worked but also turned on auto-update of apps. CP and Teams both updated overnight. I was able to reinstate both older versions and set them up again from scratch.
[General Topics] kangaroo72:
Well - today it's disabled again. I'm giving up. I need a stable solution, which now is a regular cell phone for me.
[General Topics] mGforCe:
Hello - I am unable to make Intune Company Portal and Outlook app work in my Redmi 10S MIUI13 Android 12

I have followed exact same steps as in OP - but Intune detects root. Not immediately but after like 2-5 mins.

I tried Magisk 25.2 and Denylist + Shamiko (steps as in first post)

Also tried with latest Magisk Delta, Magisk Hide enabled

In both setup, I also have Zygisk Enabled, Lsposed installed with HMA

Does anyone have a solution, any tips here?
[General Topics] mGforCe:
Inhave tried Magisk 25.2 and Magisk Delta.

Thinking to try Magisk Canary too - can you pls share the version and link pls. Thanks
[General Topics] skuppej:
Hey guys, use my solution in post #284.

You can get the latest Magisk Canary release by downloading via "Magisk | Canary" button on github.

I confirmed and this is still working on latest version of Teams/Outlook.

Clear data for all apps and don't open Company Portal after installing. Disable auto updates in Play Store just to be safe.
[General Topics] GoodSoul:
Since everything is still working on my side I would also like to recommend @skuppej solution for those where the solution is not working. For those who want to stick with their current magisk version can try to put all microsoft and all google products on the denylist (fully, incl system apps!). Maybe thats the reason why its still running on my side? 🤔

Update: Oh, and: clear the cache of at least google playstore and google play and intune as well. Yes, sucks to enter data again but solved my last issue I had with getting detect.
[General Topics] mGforCe:
Thanks @skuppej

The link for Magisk Canary is redirecting to your post #284. Pls check and correct.

For me, I was able to make Intune, Outlook work by removing Xposed and all modules. I had used HMA for hiding all xposed, magisk and root related apps from Intune, Outlook etc.

Further I observed that Intune worked well with Magisk + Xposed Zygisk + Denylist/MagiskHide. It was Outlook which was creating issues because the moment I opened outlook, on last page it gave error against Device Health check
[General Topics] mGforCe:
Ok - got the link for Magisk Canary. I was checking in Releases section on left side

Go to https://github.com/topjohnwu/Magisk

Scroll down to Downloads and find Magisk Canary
[General Topics] skuppej:
Whoops :D fixed- thanks

Magisk | Canary:

GitHub - topjohnwu/Magisk: The Magic Mask for Android

The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.

github.com
[General Topics] supermansaga:
Shamiko should be the way to go. Not sure if we still have to disable auto-update for these msft apps.
[General Topics] patrickdrd:
I'm having trouble with notifications on microsoft-teams-1416-1-0-0-2022395202.apk,

I tried updating (both teams and intune) and my root was detected :( ,

so I guess we're stuck in this version (and without notifications..) for now..
[General Topics] digger16309:
There was one day last week where I wasn't getting notifications for several hours but it was a transient issue and resolved itself. Sometimes it's just a MS problem.
[General Topics] patrickdrd:
nah, I think there is problem, at least for me, as I've said it's been a while since I last received a notification, some weeks
[General Topics] Rawdog.dll:
I managed to make it work with the following method:

Magisk hide activated

LSposed module

XprivacyLua module (LSposed)

On XprivacyLua, search for intune check them all:

By these actions, you'll make XprivacyLua circumvent any actions requested from Microsoft Intune and no longer will get Outlook closing suddenly.

See if these steps above will work for you guys.
[General Topics] supermansaga:
I read from https://github.com/M66B/XPrivacyLua/blob/master/README.md that XprivacyLua is not supported anymore. The SEP Mobile app is very nasty. If one was detected once, no matter what you do subsequently other than a whole wipe/flash, it won't work again, despite the three tests say ok.

I happen to also look at the Google wallet failure issue and want to highlight some additional modules out there that may help with this down the road. Shamiko alone may work for now. But one needs to be mentally prepare for the worst and ready to wipe. Original source #1,784 at https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/page-90. Updated below.

-- Canary Magisk [25106]

-- Wallet v.22.26.15

-- Shamiko v0.6 (whitelist)

-- kdrag0n/safetynet-fix v2.4.0

-- Displax/safety net fix v2.4.0-MOD_1.2

-- MHPC v.6.12

EDIT: Dont really need the following for the wallet nor Intune/SEP mobile

-- Magisk-Modules-Alt-Repo/sensitive_props v1 (fka Hide UserDebug v.1.0

-- LSPosed 1.8.6

++ Core Patch v.4.2

++ DevOptsHide v3.0

-- XprivacyLua 1.35 (not the original 1.34)

--Hide My App List 3.1.1

--MagiskHide Props Config 6.1.2 (w/o fingerprinting)

As Wallet and SEP mobile and microsoft works, I used Play Integrity API Check to find out I "failed" and had the red cross of "meets_strong_integrity," but can still pass YASNAC. I read on another thread that only locked bootloader and untouched can pass such check, and currently no one uses that to truly verify. So phew

SEP Mobile has all three: network/os/apps in green and zero alerts in history since I prevented everything from happening. It now says, "satisfy security policy." However, Outlook would say, "this device does not meet your organization's compliance requirements. open your organization's device management portal to take action." And upon going to the portal, the system still recognizes the earlier failure before my Android flash re-flash that didn't lock.

For this situation, only IT admin can help and if they are willing to delete all your devices, then you have the chance to start over.
[General Topics] TechX1991:
So here's an issue I ran into... I have Android 13 on my Pixel 4a. MagiskHideProp doesn't have an Android 13 option for ANY of the google pixels for the fingerprint generation
[General Topics] freburg:
Hope you can help me - i find the MagiskHide Props Config instructions quite daunting - is there an easy tutorial available somewhere?

Edit: I managed to get it to work with LSposed/XprivacyLua - but still if oyu have a link to a tutorial ill be gratefull
[General Topics] skuppej:
Hey @freburg- Use "Connectbot" to go into a terminal > `su -` > `props` to get into buildprops program.

You select (1) Edit device fingerprint > `f` > and then find your device, ie > 16 (Motorola) > 6 (Edge) and then reboot
[General Topics] digger16309:
LSPosed and Shamiko are two different things. Shamiko takes over the deny list and handles it. Having it installed doesn't work against anything. Shamiko hides Zygisk, which is part of Magisk.

I have both Shamiko and LSPosed running and also Teams and Intune.

Also Safetynet has been updated to 2.4_Mod_1.2.

And, one of the key items for not passing safetynet is running a custom ROM.

Also, users should hide Magisk (setting in the app).
[General Topics] HUN_Gyuszi:
I did not say that there is only one good solution. Mine is one that is tested. If you want to achieve goals with 'enforce denylist' method (this is my version), there is no point in installing any lsposed module because it just wont work that way. Lsposed will have a hint that enforce is ON so the modules are useless.

I am aware of that many people use happily lsposed and shamiko, but after hours of trying, I did not have luck with that. So some people need other ways.

I dont know why you blame people for using custom ROMs. There is no need to explain why we use that. There are good reasons.

For the magisk hide part, I already wrote that, but that is not enough, because many tampering detect apps will notice Zygote and many other stuff.

I am sure there are many different options - everyone chooses what is suitable for them.
[General Topics] digger16309:
Perhaps editing your post to, "This is how I got it to work on my device and my setup" would be better than how you've presented it, which is clearly written as some kind of authoritative step-by-step tutorial, which as I pointed out, contains factually incorrect information that others may take to be true.

No one blamed anyone. Run whatever you wish. I pointed it out for the sake of others reading your post because it is the #1 cause of not passing Play Integrity, and by association, possibly affecting Intune and MS apps detecting an unsecure device.
[General Topics] HUN_Gyuszi:
You might be right about this. I was in a great hurry and this is one of my first tutorials. I edited to make it clear that there are many possible scenarios and options. Thank you for the constructive comments.
[General Topics] warhawk971:
I went through too many tutorials. The only solution that worked for me

FYI: I'm using lastest version of outlook and teams with Company Portal :)
[General Topics] colognesupporter:
@GoodSoul Maybe you can add a comment in the OP, that all this solutions only working with Google Playstore/Google Services and not with MicroG?

Or does anyone successfully got this running with MicroG?
[General Topics] dereks1233:
for samsung users there is KnoxPatch(Lsposed) it works amazing you can recover secure folder, work profile and much more
[General Topics] mathorv:
On Magisk 26.1

safetynet-fix-v2.4.0-MOD_1.2.zip by Displax​

is sufficient to pass intune/teams check.

LineageOS 20 Poco F2 Pro

Displax fork:

Releases · Displax/safetynet-fix

SafetyNet & Play Integrity API workarounds for Magisk - Displax/safetynet-fix

github.com

I do not like lsposed/shamiko combo and it is not needed.shamiko and lsposed should work with magisk 25.2 however.
[General Topics] ldeveraux:
still won't work on my unlocked bootloader though
[General Topics] famusc:
I followed all the directions (Shamiko, XprivacyLua, ecc) but Intune keeps saying my device is rooted. This actually happend on the 18th of April, when my organization updated the policy. I don't know if they restricted something that was unrestricted before.

I had no problem before this policy update, even with latest version of Intune, and now nothing works.

Maybe it's the unlocked bootloader and they enforced it now...
[General Topics] supermansaga:
After so many failures, today intune/edge/outlook/edge/SEP Mobile all work for me. And they are all on the latest version with me being on April update. This is amazing considering Marriott 10.13.1 would detect root. My set up has been super simple, Shamiko 0.7 whitelist and check the apps on the denylist anyways without enforcing it. Magisk official 26101. Several XPosed modules that would cause Applist Detector to show vulnerabilities. XPrivacyLua didn't work on Marriot, so not sure why i want to keep it.

I guess folks who have been using old versions should feel safe to update their apps to

Intune Company Portal: 5.0.5849.0

Outlook: 4.2312.3

Edge: 111.0.1661.59

Teams: 1416/1.0.0.2023072702

SEP Mobile: 4.14.1

Not sure what led to this miracle. The process isn't straightforward as that on iOS. Phew! I had thought my Google location in a non-supported country was the cause of not working over a period of weeks, but I guess i am lucky. Maybe it's my openclash magic and openwrt now being on the latest release v0.45.112-beta and 22.03.4 respectively too. Hope this helps.
[General Topics] reconan1:
Hi, I have the following running,

Microsoft Intune: 5.0.5541.0

microsoft-outlook-4-2231-1

microsoft-teams-1416-1-0-0-2022395202

Word 16.0.15831.20186

I can't get Excel or Powerpoint to work, please could someone tell me which non-current version you have working?
[General Topics] supermansaga:
I can see how annoying Teams is. It checks company Portal every time one opens it up. Should you have connection issues to company Portal because you are in some unsupported countries of Android Enterprise, it will no longer refresh.

Outlook doesn't behave like that. Nor is Edge.
[General Topics] NightMean:
Thanks for this.

I have tried to use the same versions as you mentioned for O365 but Intune still detected the root.

I'm using oficial Magisk 26.1 with SafetyNet fix by Displax 2.4.0 + LSPosed Zygisk 1.8.6 + Shamiko 0.7.2 - deny list (not enforced of course) on all O365 apps that I have. I also configured Hide My Applist and XPrivacyLua to hide the app list as well for Intune.

I use couple of LSPosed modules as well e.g. Classic Power Menu, Disable FLAG_SECURE, ChatHeadEnabler, Iconify, Let Me Downgrade but I don't think these would make intune detect the root.

Does anyone else have any other suggestions? I was using 2 years old version of Intune and it worked fine, I'd like to use something newer because on A13 the battery drain from those old apps is quite huge.
[General Topics] Kris Chen:
Today I tried it to replace of MagiskSU by KernelSU in my Pixel 4XL. It's working like a charm. I don't need to setup any magiskhide or flash any USNF. It directly pass safetynet checking.

The bank app, most updated version of teams/outlook, all working well in KernelSU.

The disadvantage of KernelSU is that someone need to compile the KernelSU to fit your phone's model. Now more and more mods support for KernelSU.
[General Topics] Zeebeest1:
Have you tried running the detection test in HMA? Mine showed some Xposed modules I use (like Greenify) that were found. I create my blacklist template so it would contain all root-related applications, following this guide: https://github.com/mModule/guide_hma/blob/master/BlackList.md

Also I ran a shell terminal on my phone to see if I had previously created a "corrupt" work profile by running the following commands (make sure you grant your terminal app superuser rights via Magisk):

-su

-pm list users

This showed me the following users:

UserInfo{0:Your Name:13} running

UserInfo{999:Multi-App:4000030} running

The top user is the default profile, with user ID 0, the bottom one the work profile created with user ID 999 (for instance). I was able to delete the work profile by running:

-pm remove-user 999

Afterwards I deleted my Company Portal + Office apps, rebooted my phone, installed them again (the most recent versions) and made sure to add them back on the Magisk denylist before opening company portal. I was finally able to create a work profile, since then everything has been running smoothly so far. I run Pixel Experience 12 Plus on a Xiaomi Pocofone F1 in case you were wondering.
[General Topics] GAGANKXDA:
i'm able to run MS Office Apps with Magisk but any idea how to bypass companies restrictions to download anything from official account's onedrive app..?
[General Topics] Mani_Sundar:
Hai everyone,

Anyone having solution to fix the root detection by my intune portal ??

I'm thinking relock my mobile if there is no solution
[General Topics] usr3:
Thanks, this is the only solution that worked for me with latest versions of Teams and Outlook.
[General Topics] welshyoot:
This also worked for me after ages of pulling my hair out with it. Thank you!
[General Topics] paper88:
After configuring blacklist and enabling service in LSPosed my Nothing Phone 1 stucks in bootloop..
[General Topics] dliedke1:
Amazing! The only way it worked!! Muito obrigado!! Thanks!

(edit: stopped working 😥)
[General Topics] Tandrios:
I used to have Magisk Delta, this worked fine. Since 2 weeks I started getting root detection by Intune, so far without a solution. I've tried the last 2 suggestions, but I still have issues.

I use Intune with Outlook. Does anybody have any suggestions?
[General Topics] supermansaga:
Normal Magisk 26103 and Shamiko, the default stuff
[General Topics] Tandrios:
Thank you for your reply! However, this does not work for me. What I've enabled right now:

- Magisk 26103

- Shamiko 0.7.3 (174)

- USNF Displax Mod 2.4.0 - 1.3

Magisk app is hidden, all the Microsoft apps are hidden in Denylist (and Denylist is off for Shamiko). I work with Microsoft Intune & Outlook (and Authenticator for login).

I've deleted all the apps, installed everything again (and rebooted in the meantime) but when I authenticate Outlook, within a few minutes root gets detected.
[General Topics] reist:
Works thnx
[General Topics] supermansaga:
Maybe try Hide My Applist v3.2 as well. It's on GitHub. I don't believe I have set it correctly though. Here is what I did. I otherwise haven't tried whitelist or blacklist for it.
[General Topics] GoodSoul:
Added the following step in the tutorial because some were able to make it work by adding these steps:

- Delete data from the following Apps: Google Play Store and Google Play Services (update 19.07.2023)

- reboot your device

Edit:

The success rate for this tutorial is still very high. I have a total of 8 (!) Android devices where this tutorial works (tablets, smartphones, VMs, ...).

The problems that occur in individual cases, I can unfortunately either not understand or reproduce. Therefore, I am very sorry that I can not help you, but will continue to try my best to solve your problems.

If a step is not well enough documented or if you think that somewhere a detail to success is missing please let me know.

Despite everything: I wish you all that my tutorial leads to the goal.
[General Topics] supermansaga:
Sometimes it could be due to the unique setup by the IT at their company. I was lucky.
[General Topics] rejectedjs:
Can confirm @chaoscreater's method works perfectly running AOSPA (A13) on my OnePlus 9 Pro rooted with Magisk.

For anyone confused about the Hide My Applist setup, in the app, just tap App manage and search the listed apps and click "Enable hide", nothing else. Don't know how long this will continue to work but I'm happy it works at all. Thanks!
[General Topics] aniketdas:
Not working tried all the ways, in YASNAC everything is passed. But still in Intune it failed.
[General Topics] ykjae:
I'm able to access all Microsoft apps just fine. Btw try the new safety integrity strong fix.

What im interested in is not having copy/paste blocked within application being managed by intune/company portal. Or a pin number set up on select apps. Is there a bypass method for this?
[General Topics] supermansaga:
I don't need the strong fix from the latest mod 2.0, but the good news irrelevant to Intune is my Google one VPN now is working with the regular 2.0 mod of safetynetfix V2.4. hooray! something
[General Topics] ykjae:
Sorry for any confusion here. I'm not having any trouble accessing the apps or using intune/company portal or anything. The managing of the company portal is not allowing downloads or copying/pasting anything within the apps. I'm wondering if there is some bypass to these restrictions.

They also don't allow screenshot but I'm able to bypass that with lsposed.
[General Topics] supermansaga:
which lsposed module you used for bypassing the screenshot restriction? DisableFlagSecure 2.0.0? Thx
[General Topics] ykjae:
Yes @supermansaga but I also feel like this module could potentially work.
[General Topics] digger16309:
AOSP Mods bypasses secure screenshot, but not c/p restrictions. For Pixel and AOSP-based ROMs only though.
[General Topics] ykjae:
@digger16309 I pass screenshot restriction. But not c/p restriction. With darkeyes tricks I used to pass pin restriction too. But company portal added mdm management or whatever it's called.
[General Topics] knn130:
Hi all. My safety net passes, CTS passes, all good. but it fails to add intune company portal account. It opens, i manage to login, and when it starts creating work profile, says that it cannot proceed due to device having custom OS. Anyone have any idea how to fix? Device S23+
[General Topics] xixx:
Hi All.

I'm struggling with root detection on my backup Galaxy S7 with Lineageos on Android 10.

I overcome Company Portal root detection with (I think) latest Shamiko v0.7.3 & Universal Safty Fix v2.4.0-MOD_2.0 modded by Displax.

I have also installed LSPosed with Hide My Applist but Company Portal worked fine without it.

Company Portal creates a Work Profile and automatically installs some apps, like Outlook, Teams, Defender and some other. It successfully creates a VPN connection also.

So, all the things work BUT not Edge, Teams, Outlook apps. They all give me the Device Healthy root error. I'm stuck now and not sure what to try.
[General Topics] digger16309:
You didn't mention this but is Magisk hidden? That is the difference maker for me with Teams on A13, stock, on a P6Pro.
[General Topics] xixx:
Yes, it hidden.

I gave up :) Flashed Lineageos 19.1 with Android 12 and got 'Pixel starting...' loop because of gapps flashed after the reboot :) So, I managed to setup all my tokens on the phone, they work and all other sh@t is on the laptop. Will live with it until my S23u back from the service.
[General Topics] DrPhant0m:
I just bought an "International" S22 Ultra (SM-S908E) so that I could have root access back again... only to find that Outlook and Teams complain about root on a screen that says "Get Access" at the top, and "Device is healthy" marked with a red exclamation point.

Is there an easy way to determine what mechanisms stand in my way? I don't see the "Company Portal" that some users have mentioned... so I wasn't sure if there may be different levels of anti-root that employers are using.

If I won't be able to get Outlook and Teams working on my new phone... and for it to be *relatively* reliable moving forward... I'm going to look into returning the device or reselling it.

Thanks for the help
[General Topics] swieder711:
After updating some Microsoft apps, Root is now being detected on my Pixel 7 Pro and Pixel Tablet. I am going to try rolling back Intune to an earlier release. Anyone seeing corp apps now detecting root?

EDIT: Rolling back Intune Company portal to 5.0.5926 allows me to prevent corporate apps from detecting ROOT.

Edit2: What piece will need to be updated to get around the latest detection? Is it Shamiko or USNF? I just updated Magisk.
[General Topics] amidsal:
I can vouch for that. The new Intune (5.0.5981.0) can detect rooted phone again. I updated Magisk and LSPosed to the latest version but the new Intune still can detect root.
[General Topics] supermansaga:
I only see 5975 on app store. I somehow suspect this is a per company situation
[General Topics] digger16309:
I also see 5975 in the Play Store. It might be device-or OS version specific. I currently run 5541 and will run that version until my company forces an upgrade. I don't have work profile though.
[General Topics] swieder711:
What piece will need to be updated to get around the latest detection? Is it Shamiko, USNF or Magisk?