yashsingh1/xdaforums huggingface dataset:
[General Topics] mr_fingy:
Just to add my part to this.

I rooted my Pixel 6 Pro A14 yesterday. I managed to "hide" all but Intune. I need it for work apps so decided to flash back to stock. Intune still failed with a 1001 until I relocked the bootloader..

This may be old news, but thought I would add the info in case it helped.
[General Topics] Shuny:
Slightly off-topic because this thread is explicitly about Magisk, but for people who don't follow closely the new developments on Android, I switched to KernelSU which is a different root approach and now I do not have any issue with Intune or any app including root detection.

No need to downgrade anything, block updates, install Zygisk modules etc... it just works out of the box.
[General Topics] zgfg:
Yes, it works out of the box if kernel is supported (officially or unofficially)
[General Topics] supermansaga:
Could you please point us to the dedicated thread then? Have wasted enough time on this. Thanks
[General Topics] Shuny:
It will depend on your device. If it's recent enough, it will have a generic kernel image (GKI) and therefore you can install KernelSU by following the instructions on this page: https://kernelsu.org/guide/installation.html (basically you'll have to flash KernelSU through TWRP, as you may have done before with Magisk)

If your device is not officially supported (non-GKI device), you will need to find a kernel build for your device that integrates KernelSU. They have a page listing known maintained kernels with KernelSU: https://kernelsu.org/guide/unofficially-support-devices.html

For example, as I have a Mi 10T which is not a GKI device, I found a kernel maintaned by RealKing. The builds were available by searching it on internet (strangely, the Github page did not have a release section).

In any case, you'll have to install the KernelSU manager to allow root for your applications (you can find the APK for the latest release here: https://github.com/tiann/KernelSU/releases ).
[General Topics] mr_fingy:
I've just setup kernelsu and still failing intune. Which modules do you have installed?

Im on a Pixel 6 Pro
[General Topics] Shuny:
You need to remove everything related to Magisk and modules.
[General Topics] mr_fingy:
Yea. It was from factory. I had previously unrooted and relocked bootloader untill today, so when I unlocked BL I was data wiped.

Which modules do you have running?

Are you on latest intune?
[General Topics] Shuny:
I have Intune 5.0.6032.0 and I am not using any modules.

I'd say if you device still gets detected, you have something else triggering the check. As far as I know KernelSU can't be detected at all due to being located in the kernel (also, it is still not widely known so I don't think any app is actively trying to detect it).

You said you wiped data, but Magisk flashes the boot partition so I am not sure you have a fully removed Magisk installation
[General Topics] supermansaga:
It appears Pixel 8 Pro can be supported. Hopefully there will be video tutorial. Who is behind KernelSu? Chinese engineers? And what fake location thingy could work in KernelSu situation? GPS Setter says they only do Riru/Zygisk under Magisk? Thanks
[General Topics] mr_fingy:
Yea, I restored via PixelFlasher and boot.img. At that point intune still failed and yasnac failed on CTS. I locked my bootlader and they both passed. That was before I attempted KernelSU.

Yesterday I unlocked bootloader, built the boot.img using magiksboot, flashed with KSU and added a few safeynet modules before attempting Intune.. from my experience it seems that Itune is detecting bootloader unlock as well as root.

I'm back on stock now but may retry with default KSU later on.
[General Topics] DrPhant0m:
This is slightly related, but very interesting (to me, and I assume all of you, as well)...

I had been using a Note20 Ultra (unrootable US version) until the camera focus broke, and I bought an S22 Ultra (bootloader-unlockable International Edition). I was blissfully unaware that InTune was monitoring my root/bootloader status on the Note20, since rooting was not possible.

When I unlocked the S22 and rooted it... and proceeded to install Outlook and Teams, I first saw the root check via InTune. So... I used my Note20 to get my work email until I figured things out on the new phone (still figuring...)

Here's the interesting part...

Eventually, I started seeing the "device non-compliant" screen on the Note 20, as well! WTF? The phone was never BL unlocked or rooted. I didn't change ANYTHING on that phone after I got the new one. I would just pick it up to check my work stuff.

Someone explain THAT, please. I'm worried that InTune somehow marked my account as "dirty" and isn't letting me access it on ANY mobile device... and I've been waiting to hear from IT over this.
[General Topics] supermansaga:
You should be fine, unless even your work laptop or desktop is tainted. I am sure someone at IT is monitoring, but until they really reach out to you, there is nothing you can do. Just my two cents. I obviously don't have any background in IT.
[General Topics] mr_fingy:
From my experience, I used the same "dirty" device after locking BL and it passed straight away. So i don't think it backlists.

Im not sure if it flags failures in a console or anything, but its my personal phone so I'm not too fussed. I only install Teams and Outlook on my phone in case I "accidently step away from my desk"
[General Topics] mr_fingy:
Just gave this another go today with success on the latest intune :)

CTS Profile still failed due to bootloader, so added module:

Universal SafetyNet Fix 240 mod 2.0 https://github.com/Displax/safetynet-fix/releases

Zygisk Next 4-0.8.1 https://github.com/Dr-TSNG/ZygiskNext

I am even able to added the LSPosed module without detection.

Bank app and Google Pay all working
[General Topics] supermansaga:
what device you are using? How about Google one VPN?
[General Topics] mr_fingy:
Pixel 6 Pro

and yes VPN connects
[General Topics] supermansaga:
So Zygisk Next is the trick here?
[General Topics] mr_fingy:
Yea. But I didn't try it on its own, just with with Safeynet fix so not fully confirmed it was Zygisk alone.

As well, safetynet/CTS failed with stock and open bootloader, which is how intune detected poor device health.

As of now, nothing fails. I've even just Nuked trackers with Warden and still all ok
[General Topics] supermansaga:
Not following the nukes trackers with warden part. Can you elaborate a bit more please?
[General Topics] mr_fingy:
I was just making the point that I've made significant changes via root, and still no intune trigger

This is Warden I'm on about

[APP] [5.0+] Warden - App Manager

Warden Disclaimer: Warden uses root permission to enable/disable components & de-bloat. Use at your own risk! Features: Detects Trackers & Loggers across whole device Allows to disable all trackers/loggers Advance profile...

xdaforums.com
[General Topics] mr_fingy:
Just downloaded lucky patcher and didn't even give it root yet intune is triggered. Going to restore device and re add modules as I can't get it undetected
[General Topics] dtkent:
Shuny is right -- KernelSU is the way. I've got all my MS apps working again, and my workplace is pretty aggressive about security (separate Work profile, aggressive root detection, etc).

Using KSU on Pixel 6 Pro. Because of the weird kernel encryption on Pixels, I had to manually create the boot image file. I tried using Android Image Kitchen but it didn't package it correctly -- I ended up having success using the described magiskboot method. I also use AdAway, which requires systemless host support, and which causes root detection itself by Company Portal if the host file is modified. So, within KSU I am using the following modules:

-systemless hosts KernelSU (to allow AdAway to work)

-ZygiskNext

-Shamiko

-USNF (to pass CTS check)

AdAway KernelSU helper did not work for me -- I had to use systemless hosts with zygisknext and shamiko to hide it all.

V pleased with KSU so far, wasn't too bad to configure/install and I actually find it simpler and less cludgy than Magisk. Hope it works for you!

Thanks Shuny for the KSU tip!
[General Topics] mr_fingy:
Thanks !!

I was just about to give up and "Shamiko" was the missing piece !!

systemless is also nice to get AdAway updaing correctly
[General Topics] dissidius:
Hello everyone, I'm using a S10+ with latest project elixir android 13 rom. Attached screenshots on how i achieved "hiding" root, being play protect certified, luckypatcher, lsposed, and hiding even from Microsoft Intune and related apps detection. Cheers and hopefully someone who's struggling finds this 😉
[General Topics] WarriorMax:
Thank u soo much. Finally outlook worked fine
[General Topics] JGoldz75:
Hi all,

I'm hoping I can get some assistance here, as I am unable to get my Work profile apps to work without almost immediately having the data removed by the org due to root detection.

Here's what I've done so far on my Pixel 5 running LineageOS 20:

Magisk 26.4 Installed

Play Integrity Fix Module Activated (I also have tried SafetyNetFix 2.4.0 but no luck)

Shamiko 0.7.4 Module Activated

Company Portal v5.0.5926.0 Installed and updates blocked via UpdateLocker

Zygisk enabled

Enforce DenyList disabled

All Microsoft apps added to "Configure DenyList" with all possible options checked when expanded

Magisk hidden as shortcut

YASNAC (Yet Another SafetyNet Attestation Checker) basic and CTS profile are both "Pass"

Since all of these previous steps failed, I also tried installing Magisk Delta. This did not work either.

After all of this, I still am getting the notifications that my organizational data is being removed because a rooted device was detected.

Anyone have any ideas on what else can be done??
[General Topics] ashes:
I am currently facing the same issue.

Somehow Intune disappeared from the UpdateLocker and got updated.

It detected root automatically.

I uninstalled everything :( and wen to setup again.

Exactly as you described and still detects root .... I wonder if I need to wipe data from google services framework :(
[General Topics] supermansaga:
You are not using Android 14, right?
[General Topics] ashes:
Running Android 13 on a Galaxy S10+

Oneui 5.1.

Security patch level is from March, but I edit the props and set to November. Company portal identifies the security update from November.

The only thing that is failing is the root detection, which I don't get it from where he detects :(
[General Topics] dtkent:
Yes, 14.0.0 (UP1A.231005.007, Oct 2023) for P6P
[General Topics] supermansaga:
but doesn't KernelSu require twrp which yet to support Android 13?
[General Topics] ashes:
I finally got it.

I deactivated LSPosed and Intune did not detect root anymore.

So I enable it again, but this time only kept the KnoxPatch module enabled and it also worked.

FYI, Intune detects the modules "Hide My Applist" and "UpdateLocker" even if I add all microsoft apps to the list.

Cheers
[General Topics] zgfg:
Who and where says that KermelSU requires TWRP

You have to flash boot.ing with the modified Kernel - so you can always flash directly from Fastboot (no need for TWRP):

fastboot flash boot modified-boot.img

About installing KernelSU, see:

Installation | KernelSU

A kernel-based root solution for Android GKI devices.

kernelsu.org
[General Topics] solar666:
Which magisk?

For me using using alpha + shamiko everything fine here even using zygisk + related modules
[General Topics] nieebel:
YES!!!!! Thank you very much :)

My *working* setup now:

Magisk 26.4 (renamed; denylist configured as dissidus has shown)

LSPosed Zygisk mode 1.9.2 (7024) (parasitary mode (="uninstalled", but still notifications), no Module, Hide My Applist deinstalled, MS-Intune seems to work without)

Shamiko v0.7.4 (188)

and those modules, but they should not make a change:

MagiskHide Props Config v6.1.2-v137

Play Integrity Fix v13.0

MS Teams 1416/1.0.0.2022395202

MS Outlook 4.2247.1

MS Intune 5.0.5691.0

My Device: Samsung S4 i9505 Optimized-LineageOS-18.1-20201215-Version1

edit: stopped working 2 weeks later :(
[General Topics] dohanin:
Which version of Magisk and Shamiko do you use? For me, it has been working fine since Magisk 24.3 and Shamiko 0.4.4. (now I'm using Shamiko 0.5.0)

You may as well try the following:

- reinstall the shamiko module

- clear all data of Intune Company Portal, kill it, and reboot

- make sure you check all the boxes of Intune in denylist but do not Enforce Denylist

- make sure you can see "Shamiko is working as blacklist mode", reboot

- try root detection tools and make sure they cannot detect root/magisk/zygisk, e.g. Momo, Oprek Detector, rootbeer sample

Also, for me I always freeze the magisk app too because some bank apps can simply detect it if not frozen even if it's repackaged in another name. You may try this as well before using Intune.
[General Topics] azerty9971:
Hello all,

I had the issue as well before and the latest magisk canary fixed it ...

Before that intune was failing on "device is clean", since today's update (or yesterday's).

Let me know if it fixed it for you as well :)
[General Topics] dohanin:
Good to know.

I'm using Beta channel of Magisk, so I'm still on 24.3 but it's still working fine for me with the latest Intune.
[General Topics] shadow460:
If the company wants to put software on a phone, they can pay for that phone. They also need to know I come with my own cell phone and will carry my phone almost exclusively unless I need their software. I have $300+ in this old Moto G7. (bought it new and just 'cause it's old doesn't mean I throw it away). No one tells me what to install or how to run it.

That said, I am interested in learning the newer Magisk releases. The last time I update it it caused a mess, but I may try this on my other G7.

I've actually run a lot of company stuff on my personal devices, many of which are rooted or to which I have exclusive admin access. CMS Tech, TELS, any number of spreadsheet programs, you name it, unless it's Microsoft (and even then in many cases) I've run it on a rooted device. I access my bank accounts on a rooted phone *without* hiding Magisk, I don't need to hide it anymore.

That said, certain info never makes it to my phone. I work in a hospital. Patient info will never be on any of my devices or even in pen&paper notes and if I find any of it there besides my own, I'll delete it.
[General Topics] pelicant:
I'm trying to bypass the USB debugging disable and unknown sources disallow (it's disallowed in both profiles, not just work, so it's the global disallow)

I thought the best way would be to rebuild the intune app, and add

android:testOnly="true"

to the manifest, then repackage the application and run something like this:

adb shell dpm remove-active-admin com.microsoft.windowsintune.companyportal\.DeviceReceiver

Haven't tested it, but I'd really like to avoid using a command line whenever i want to install an app, and i will probably miss being able to use adb if it has to be disabled.

Perhaps this can be done with a magisk module or LSPosed? Or, rather than editing the manifest, LSPosed could disable all calls that restrict permissions on the DeviceProfileManager and UserManager
[General Topics] jbradshw:
This was working great, but the latest update of the app is detecting root now, at least for me.
[General Topics] sigfy01:
Same here unfortunately.

Only change is an update of Intune app that happened today.
[General Topics] jbradshw:
When I reboot, my apps work for a brief amount of time before Intune flags it again.

A couple of things I did that seems to help/work (so far) is I unselected the Intune and my work apps in the Magisk DenyList, and then rechecked all of them. I also used Hide My Applist and hid the Intune app. Not sure if this will hold up but so far it's lasting longer than before.
[General Topics] dohanin:
How did you config HMA to hide Intune app? I mean are you hiding some apps from Intune, or hiding Intune from some apps? What apps then?

Thanks.
[General Topics] jbradshw:
Well I went to grab a screenshot to show you and I noticed I didn't save what I did in HMA so it was never in effect. However root is still hidden so I think unchecking and rechecking the apps on the deny list is what did it. Every time I launch Outlook though, it does a check whereas it didn't do that before the update.
[General Topics] jbradshw:
Nevermind everything I said. It's detecting root again. :( Maybe the next version of magisk or shamiko will help here.
[General Topics] dkannegi:
Using a Ulefone Power Armor 13 with my work (uses Company Portal - not Intune)... to get around the errors: flash the stock bootloader in, launch everything up, pin create, etc... Did this with every M$ app tied to Office 365 so they make their data blobs. Once done, re-flash in my Magisk patched bootloader (with my phone I have to flash via fastboot anyways). Office 365 works again. If using SafeyNet fix while rooted, don't delete the old device as bootloader swapping may cause a new device to show up in Company Portal (don't delete this either) - the apps still refer to that older device blob and then pass it since root becomes broke with a stock bootloader. Hope this works for others...

For setups were a full blown work profile is on, one can try the bootloader swap post update, and then work the profile to allow it to build up, and then try and swap back to rooted. Be careful doing this on Samsung devices if Knox is being used... one mess up with that blowing it's eFuse and it's game over for anything work related that audits Knox.

In a pinch if Teams really throws a fit, throw a web browser on in with 'desktop mode' turned on, if your work allows browser access it can work.

The short of it is the apps are picking up root which means Magisk has to up its game. This is going to be a BIG cat and mouse game between Magisk and Micro$oft (who has big pockets being lined by Fortune 500 and most of NATO's governments).
[General Topics] Phat7:
Same has started happening on my OP7 Pro since yesterday.MS has found a hole to detect root. It was working perfectly before. I guess we have to wait for a Magisk update.
[General Topics] Phat7:
When you flash stock boot and then the patched one, is there a risk it could make you wipe data? That's the biggest fear I'm worried about.
[General Topics] rahulcasper:
Thank you so much i can't help but laugh that all it took was unselecting and then selecting the apps again in denylist. I was losing my mind since yesterday trying different root hiding modules and methods. I think I probably set up my work profile 30+ times lol. This is working..... For now🫡🤞
[General Topics] rahulcasper:
Spoke too soon it's gone again 🥲
[General Topics] jbradshw:
That ended up not holding for me. However I did roll back the Intune version to 5.0.5541.0 (get it from apkmirror), which required me to fully uninstall the app and then installing that one and re-setting up my work profile. I then unchecked the app to auto-update in the play store. So far so good, but I'm sure it's going to force me to update that app soon to keep using it.
[General Topics] sigfy01:
Thanks, the rollback did work for the moment and is far easier than uninstalling/unrooting and then reinstall/reroot.
[General Topics] rahulcasper:
Yea se after a while it got detected again. This roll back did the trick. Thanks a lot. Hoping a magisk update fixes it by the time we are forced to update company portal app
[General Topics] Sage:
Looks like downgrade is the go thanks
[General Topics] DrPhant0m:
Does anyone else have the same issue as I do...? When I first restart my phone, I can access MS Outlook and/or Teams, but eventually (within minutes/hours), opening either app again will cause the "Device non-compliant" screen and cites that I have a rooted device. I will then be unable to access the apps until I restart.

I am using a Galaxy S22 Ultra running DrKetanROM version "T11." (This ROM is not encrypted, which may/may not be a flag) Android v13 with August 1 security patch.

Running Magisk 26.4, Shamiko 0.7.3, MagiskHide Props Config v6.1.2 and Island 6.2.1 (with Intune, Outlook, and Teams in the work profile/"island").

Please ask any questions, offer suggestions, etc.

Thanks!
[General Topics] thobi3:
good morning!

my work profile is offline since yesterday. intune cannot connect but neither can outlook nor WhatsApp are online receiving messages. however, I do receive notifications for new mails. clicking on them opens Outlook work the error that the message cannot be found.

anyone else having similar issues with v 5.0.5975.0?

Thanks!

Edit: Apparently I had to change my device pin after 3 months. company security rules. jeez.
[General Topics] DJionut123:
For anyone still struggling, I've spent months w/o access, I would get to the last step and it would tell me I need to install Company Portal, even though it was installed. IT support basically checked and double checked my account, settings, licenses, etc. and said they were fine. I read a response in this thread or in another and had the idea to turn off hide my applist. Rebooted, cleared storage of all MS apps, logged in, and voila, back in business. So seems like HMA is not required.
[General Topics] labbala:
have Samsung Galaxy S23 Plus.

Using company portal app back dated to april 2022

have all installed latest versions to this post date (29 Nov. 20203):

Magisk Delta (kitsune)+ hide all needed apps (fully expended each) - without Enforce deny-list

Zygisk next

play integrity fix

passed basic integrity and device integrity

deleted cache and data for Play store and Play Services

rebooted the phone

before app manager changes i have gotten company portal after login give message with title:

"Can't create work profile"

with message content:

"The security policy prevents the creation of a work profile because a custom OS has been installed on this device"

using App Manager i have changed only the bold items as recommended:

[Tutorial] [Root] How to configure 'Microsoft Intune' to make it work with 'Magisk' (Update: Q3/2023)

Update 04.01.2023: I've added shamiko magisk module to make this tutorial work again. Update 19.07.2023: Some were able to make it work by cleaning the data of Google Play Store and Google Play Services. Added. This question was asked many times...

xdaforums.com

Omadm client service

Omadm client service api 26

Due to the changes of app manager i'm getting application timeout that it can't create work profile since the device doesn't support (see attach picture for message)

can't make it work for me ..
[General Topics] nieebel:
Same here.

Restart helps only temporary.
[General Topics] docluv01:
Same here :(
[General Topics] WorldOfJohnboy:
Pixel 8 Pro, downgraded Intune Portal, can't open MS apps. CTS is failing and changing fingerprint does nothing... any suggestions?
[General Topics] Brocklenser:
This approach was effective initially, but upon activating the Enforce Deny list, severe lag issues arise. The phone functions smoothly without this option, but Intune detects root and imposes restrictions. A more optimal solution is desired; this problem never occurred with MagiskHide.
[General Topics] docluv01:
some people on reddit have claimed they have it working with the delta variant and hidemyapplist. anyone else try? I downloaded hidemyapplist but unclear how to set up. will have to read more on it.
[General Topics] WorldOfJohnboy:
Well CTS is still failing, but I re-installed Shamiko and went back to Intune version 5.0.6078.0, set to Deny and somehow it works. Totally baffled but happy!
[General Topics] docluv01:
really? isnt that the latest intune?
[General Topics] WorldOfJohnboy:
Yes, I believe it is. Just went back into Outlook and still working! My only thought is Shamiko had something going on with it. Thankfully, this setup has always worked on my Pixel 8 Pro until yesterday.
[General Topics] docluv01:
For what it's worth, I switched to the latest delta magisk, and enables sulist. Enabled my root apps and outlook working.
[General Topics] DaCHeF36:
Same here on a Pixel 6 with 12/2023 security patch. This works great. KernelSU FTW!
[General Topics] laolaxyz:
Did you find a solution ? I am using basically the same ROM and setup (just S21U instead of S22U) - and the same problems...