yashsingh1/xdaforums huggingface dataset:
[General Topics] Horrorfiend666:
Cant access Company Portal , Teams our outlook on my google pixel 7 keeps telling me im rooted

I have

Playintegrity fix

Universal SafetyNet Fix

playcurl

shamiko

I am able to get into teams for a brief moment then get hit with the non-compliant message

I am using magisk hide and even renamed the magisk app
[General Topics] mGforCe:
Pls check this thread for latest solutions. Varies by Android version, ROM etc

[Tutorial] [Root] How to configure 'Microsoft Intune' to make it work with 'Magisk' (Update: Q3/2023)

Update 04.01.2023: I've added shamiko magisk module to make this tutorial work again. Update 19.07.2023: Some were able to make it work by cleaning the data of Google Play Store and Google Play Services. Added. This question was asked many times...

xdaforums.com
[General Topics] Horrorfiend666:
thanks got it working
[General Topics] amplatfus:
Could you please share what steps did you followed?

Thanks!
[General Topics] Horrorfiend666:
Realized i didn't infact have the universal safety fix installed so installed that

Also installed the magiskhide props config wasn't able to do anything with it as it only gives options upto android 8.1 so all in all installing the universal fix resolved it
[General Topics] Spardorp:
I found this thread and it helped me!

Magisk hide + Force Denylist for portal and teams + Zygisk + Install Shamiko (Magisk module)

Now the Teams registration continued (no more complain about a rooted device).

Thanks.
[General Topics] b00ster23:
Okay, so for me I hit up this thread for my 'spare' Pixel 2 work phone running the lates Evolution ROM. I don't have a valid SIM, and don't use this phone for anything by my work apps over WiFI. I could have just went to a stock ROM and been done with it, but since it's an older phone I wanted the latest OS platform with security enhancements.

So I read thru this string extensively, and tried all kinds of variations of the OP's method, as well PIF. I would still have issues when it came to registering my device for me in the company portal. Finally, the last option was to 'remove root' . After I was able to get the Play Integrity API checker to pass the necessary tests, I updated the OS to the latest Evolution build. Of course, now when I launch the Magisk hidden icon, I get the message "The hidden Magisk app cannot continue to work because root was lost, please restore the original APK"

For me, and my use case, I don't care about root so I left it as is. And with that, I launched Company Portal and we were back in business again, and assume the applications use the same check and didn't see root as well.

Just because I haven't seen this method used here, thought I would post my findings for anyone else that might want to use this process. :)
[General Topics] supermansaga:
what's the MagiskInit that John Wu tweeted about? Is it an upcoming solution to this pain we are dealing with? He said passed all tests. What does that even mean? Thanks
[General Topics] zgfg:
You could have posted the screenshot with his tweet to see what is it all about

Passing all tests - he doesn't test (neither cares about) Intune, and not even Play Integrity or all kinds of hiding. He tests the Magisk functionality

Btw, you already have and it is used when booting and initializing Magisk:

/data/adb/magisk/magiskinit

It's probably a new version, improved and so

First, he is employed by G and he had to distance himself from hiding

Second, it's impossible to test an all phones, with all banking apps, all kinds of Intune configurations, etc

Magisk is just a platform that provides the root and framework for modules. Developers develop the modules and you, as the end user chooses which modules you need, how to configure them etc. And user has to take care to have his phone and apps working

If sensitive apps don't work, reinstall clean stock and relock Bootloader
[General Topics] rdorsch:
Hello,

I have lineageos 21 on a pixel 3a with magisk and play integrity fix, zyg, blocking, Shamiko

Safety Net passes Basic integrity, CTS profile, and has evaluation type BASIC.

When I run Intune it reports

My device does not meet the requirements of my company to enroll...

The security patch level must not be older than 3 months. Which is the case for the Android security update, but not for the vendor security patch level (2022-05-05). I am wondering if intune checks the vendor security patch level if requested by the company and if magisk can patch the vendor security patch level (at least for some apps).
[General Topics] xeliya4518:
well, my apps are working but I have a message "Your device does not meet your organization's requirements to enroll..."

is it possible to get rid of it with exiting methods?

I am asking because apps are working but calendar widget isn't allowed
[General Topics] zgfg:
SafetyNet is long ago obsolete.

You could pass SN Basic and CTS but that does no guarantee that you will pass Device Integrity from Play Integrity
[General Topics] rdorsch:
I pass Device Integrity and Basic Integrity. I don't pass Strong Integrity.
[General Topics] TnargNaanac:
Something updated overnight and now intune is detecting root. Version 5.0.6180.0

Was working fine since late last year, but now nothing. Magisk 27.0, PIF 15.9.4, Shamiko v1.0.1 (300). Still passing basic integrity, failing strong.
[General Topics] zgfg:
>>Still passing basic integrity, failing strong.

And what about Device Integrity (that one is important)
[General Topics] TnargNaanac:
Yep passing device integrity too.
[General Topics] Kh4os:
Intune auto-updated from the Play Store for me this morning(5.0.6180). Reverting back to the Feb patch (5.0.6157) and clearing app data from Teams/Outlook let me reconnect everything.
[General Topics] TnargNaanac:
For me, Intune itself is managed and I cannot downgrade it.
[General Topics] vukis:
Same here just got root detected window again. Checked intune versions 5.0.6180...

Again need to play that cat and mice chase game..

Tried some earlier versions, but outlook and edge complained that intube is outdated.

Feb patch 5.0.6157 works for now.
[General Topics] liber:
Same here since yesterday. Intune 5.0.6180... I tried multiple solution but no one works now.

Any help would be really appreciated!
[General Topics] TnargNaanac:
One strange thing I get are automated email warnings about needing to be on android 9 or higher, even though I'm on 14. I assuming this has something to do with PIF?
[General Topics] SoloTSi97:
Looks like I'm in the same boat as others. I was running some early 2022 version of Intune until week ago when Outlook started complaining that it was too old. I've tried various versions from Feb 5.0.6157 back to a late 2022 version (5.0.5616). Earlier versions work at first but within a couple of days it detects my rooted phone.

Pixel 7 Pro, unlocked bootloader, latest Magisk + Shamiko + HideMyApplist. This setup has worked for a year now but no love now. :-/
[General Topics] liber:
I solved with Kitsune canary.

Attached my settings
[General Topics] vukis:
Play integrity fix is 15.9.6. Mine (using magisk) was outdated. Updated, but don't want to update company portal as I really would not want to go over that company profile setup again :)
[General Topics] TurboLed:
EDIT: I have upgraded from official Magisk to Kitsune Canary and it worked.

However I'm not sure Play Integrity Fix is working correctly, all the checkers are showing failing device integrity. Google Wallet and everything else seems to work normally however.

EDIT: Device integrity worked after adding FP downloader to SuList (need to show System apps)
[General Topics] charlessxavier:
Thank you guys. My outlook and teams stopped working. After following your guidance i replaced my alpha magisks with kitsune, and it started working again like a charm. Thanks again !
[General Topics] WarriorMax:
Thank you soo much. Its working with kitsune.
[General Topics] ykjae:
What would be causing alpha to break company portal and not kitsune? I'm using alpha and mine just broke but would prefer to stay with alpha.
[General Topics] R56:
I like to think of it less as something breaking, and more along the lines of the Microsoft and banking apps figuring out another way to detect root. Magisk, Alpha, and Delta / Kitsune all have different ways of rooting. I don't know if any one is more root-detector-proof, but I feel like in the past 12 months or so I've had more issues with Magisk Canary than I used to.

Yes thank you, seeing this and other reports of Kisune working made me finally switch over.

P6P and I was on Magisk Canary + Shamiko. Intune, GPay, and banking apps were all working fine until last week.

Followed Kitsune instructions and installed in Magisk as a .zip module. Zygisk + MagiskHide + Enforce SuList. Only "issue" I had was starting the Magisk app instead of the Kitsune app and thinking I lost root, ha! 🤷‍♂️

Aside from that, Shamiko wasn't working, as expected, but I purposely didn't remove any modules or otherwise clean anything up from my Magisk Canary setup. I wanted to be able to switch back to Canary if Kitsune didn't work out.

So far I'm going to stick with Kitsune. I definitely like the whitelist approach of SuList where you select the apps that get root, as opposed to everything getting root and using DenyList to carve what you want to hide from root. With DenyList I was always worried about not selecting the right apps.
[General Topics] LisandroSC:
Hey, can anyone provide a step-by-step guide on how to migrate this whole thing to Kitsune Canary? I've tried following the steps provided in the installation guide and I end up loosing root. Thanks in advance!
[General Topics] R56:
From https://huskydg.github.io/magisk-files/ I went with:

Or flash Kitsune Mask from the current Magisk app

Rename the extension magisk.apk to magisk.zip

Open Magisk app, click the “Modules” tab -> “Install from storage” and choose magisk.zip

I did this and didn't open the Kitsune app, I opened the regular Magisk app. When I did that it looked like I lost root. When I opened the correct Kitsune app everything was fine.

If you have lost root already, as far as I can tell you just root it the way you would with regular Magisk.

Also I ended up installing Kitsune Debug.
[General Topics] LisandroSC:
After doing this, should I need to repeat all of the steps in the first post of this thread?
[General Topics] R56:
No, it works a little differently.

I followed the screenshots in https://xdaforums.com/t/tutorial-ro...h-magisk-update-q3-2023.4402273/post-89411109.

Basically, enable these in Kitsune settings:

Zygisk

MagiskHide

Enforce SuList

For modules, at a minimum I think you still need Play Integrity Fix, I'm using v15.9.6 by chiteroman. Shamiko won't work here.

When you configure SuList, remember that this is a whitelist, not like the other DenyList which is a blacklist. You are selecting the apps you *want to have root*. From the screenshots I also selected com.android.settings. Beyond that it's up to you what needs to have root.
[General Topics] LisandroSC:
I'd say this one is indeed needed since I could only access Teams after I have installed this module. Thanks!
[General Topics] Quake94:
Kitsune appears faster than Alpha, I had a terrible system lag before
[General Topics] TurboLed:
Maybe the whitelist (SuList) approach is part of the fix.

Otherwise one needs to figure out which hidden system process running in the work profile to add to DenyList.
[General Topics] Steve0007:
Not sure as even without using Sulist on kitsine doesn't make intune/outlook/Teams dedecting Root.
[General Topics] conspiracyBE:
When I do this on my Google Pixel 7 Pro, it looks like it installs fine but my phone will no longer boot when I choose reboot at the end. I just get the "Unlocked bootloader message" > "Google boot logo" > "Shuts down with black screen".

I had to re-install the normal magisk via recovery menu to get my phone back working.
[General Topics] snoopsean88:
So I posted earlier about getting teams to run, so it's not exactly about intune but it's related. Here is a recap for anyone that stumbles on this thread looking to at least get teams going if it doesn't like rooted phones

Magisk 2.64 zygote enabled

Latest version of Google play services 241017022

Latest teams 2024053033

Uninstall intune company portal if present

Clear data on services and teams

add teams to deny list

Open teams and sign in. (It should make you go through full sign in process. If not then do all the above steps again and restart phone before signing in. It should not use cached account credentials)

It will ask to install intune. Click cancel and keep going through prompts until it ends up saying you need intune.

Close out teams

an older version of intune 6561938

Don't open it. Make sure to add it to zygote deny list (all of it so expand it in the deny list there are 7 subsections of intune company portal)

Now open teams, it will download the intune policies but won't choke.

Close out and reopen teams and it will say device is healthy. It may ask you to set up a pin based on your company policy

It will then say "encrypting your data" and that takes a couple minutes
[General Topics] TnargNaanac:
Me too in my Pixel 8 pro. I tried using the "direct install" option and netted the same results. I think it's because on pixel 8 you have to patch init_boot.img instead of boot.img. I think we need to patch init_boot with kitsune like the normal way to patch for magisk.
[General Topics] zgfg:
For Pixels, use Pixel Flasher (from PC), it will take care what/how to patch and flash - another thread on XDA
[General Topics] Prydateer:
Followed the initial post but it s not working here. Check my screenshots. What an I doing wrong?
[General Topics] adinechin:
From my point of view you need:

Install "kitsune magisk"

Hide it and complete the installation (I suggest to avoid rebooting yet)

Activate "Zygisk"

Activate "MagiskHide"

Activate "Enforce SuList"

Install "Play Integrity Fix"

Reboot

After reboot, check in "Configure SuList" only the apps you want to have root with
[General Topics] swieder711:
Switched to Kitsune Magisk. Followed the directions above. Now have root and can run Outlook and other corporate apps.
[General Topics] SC-Mroj:
Spent almost a whole day of getting this "Intune crap" working. And also almost lost my root when experimenting with Kitsune. (I do not recommend, the installation failed several times for me with horrible errors.) I ended with this configuration which is now working for me perfectly:

Standard Magisk Alfa 27.0

Hidden Magisk app in Settings

Zygisk Enabled

DenyList Disabled (Play Store, Play Services, Intune and all MS apps + Play Integrity / Root Checkers on the list)

My modules:

BCR 1.61 by chenxiaolong (irrelevant)

Play Integrity Fix 15.9.7 by chiteroman

Shamiko 1.0.1 by LSPosed

Systemless Hosts 1.0 by Magisk (enabled in Settings)

Zygisk 1.9.2 by LSPosed with Hide My Applist 3.2-410

Intune and all MS apps have blacklisted Magisk (IMHO the most important part)

My Play Store / Services and Outlook are last available versions, but Intune is 5.0.6171.0 from APKMirror (also important).

Tested on SAMSUNG Galaxy A34 5G, Android 14, One UI 6.0, Security level 1.1.2024
[General Topics] BrimoFan123:
So you need to make sure Intune Company Portal it is not updated in order to be able to open Outlook having standard magisk?

Thats short term solution then. You could expect a day when you will be not able to open Outlook receiving massage like "can't be open because Intune Company Portal version is obsolete"

Migration from Magisk Canary into Magisk Kitsune is easy and I did that without any issues.

Currently having Intune Company Portal version 5.0.6215.0 and Outlook works.
[General Topics] Frost90:
Back with update, got it to work finally.

The settings/apps/modules used:

Magisk Kitsune 27001

Magisk App Hidden

Zygisk Enabled

Magisk Hide Enabled

Enforce SuList Enabled (You need to Configure SuList for apps which require root)

Play Integrity Fix 15.9.7

Latest Company Portal 5.0.6198.0 works

Google Wallet works

Most banking app work, not all.
[General Topics] vukis:
How come everyone taking switching to kitsune so lightly. Did shallow research on Google and In reddit I read some controversial things about kitsune: "[Discussion] Is Magisk Delta (Kitsune Mask) still safe?" I might be to overly cautious, but I am staying away from kitsune as long as I can.

So now I am sticking with orig magisk and non updated inTune app till it works without outlook or teams requires new inTune update. Last time it was around 6 or 9 months.

When inTune update is mandatory then there maybe a new magisk update available
[General Topics] yuorfaec:
Never a bad question, especially given the recent events with xz/Linux. As far as I could tell from the Reddit thread you referenced and some branching searches from there, there are three broad concerns:

developer immaturity, particularly in response to upstream drama (lsposed/xposed)

concerns that original magisk + certain modules accomplishes what kitsune aspired to

disagreements on working in user space vs kernel space

As far as I can tell (not being an expert in development), there has been no evidence of malicious code in Kitsune. But it is substantially more difficult/impossible to prove the lack of malicious code definitively.

Each of the listed concerns is valid, and if one is a dealbreaker, it's understandable to choose a different approach and communicate your concerns. I would advise, however, that others don't share the same concerns, or their use case requires this approach. But until we have proof of malicious activity, your personal risk tolerance with open source community projects will be your guide.
[General Topics] BrimoFan123:
Steps I performed:

0. Note which applications you have added into Deny List in Magisk Canary.

1. Unhide Magisk app in Magisk Canary.

2. Disable all modules in Magisk Canary.

3. Install Magisk Kitsune Canary app version

4. Rename Magisk Kitsune Canary app to zip

5. Install Magisk Kitsune Canary zip as the module inside Magisk Canary. Reboot.

6. After reboot uninstall Magisk Canary app.

7. Launch Magisk Kitsune Canary app.

8. Enable modules one by one and reboot after each of them (do not enable all of them because then it would be difficult to find which module potentially causing issues)

9. Hide Magisk app

10. Enable option MagiskHide

11. In Configure MagiskHide option select applications which you want to hide from root detection.

12. Shamiko module is not compatible with Magisk Kitsune - can stay disabled or remove it.

13. Add in the list of "Configure MagiskHide" Google Play Services (it was not needed with Magisk Canary because Shamiko module take care for hiding root detection from Google services but in Magisk Kitsune need to be added to the list)
[General Topics] xeonight:
When I did this from an already Magisk-rooted device, I got a bootloop, had to restore the boot.img (Pixel 8 pro)

Im thinking that I need to patch the boot.img with Kitsune, then flash it, but I haven't tried this yet.
[General Topics] R56:
I'm on a Pixel 6 Pro and I switched from regular Magisk to Kitsune using the method I mentioned, installing Kitsune as a module.

The recommended approach from https://huskydg.github.io/magisk-files is Direct Install. Have you tried that? I forget why I didn't do that in the first place, but if you haven't tried that already it might work better for you.

Also, I used the Kitsune Debug release, not the stable one.
[General Topics] TnargNaanac:
You need to patch the init_boot.img with kitsune. Direct install also causes bootloop
[General Topics] NightMean:
With the Enforce SuList you also have to take into mind that not all Zygisk modules are compatible with it.

I use Zygisk module `Pixelify` which is not compatible with it so the whole system locks up upon boot. Had to use `adb wait-for-device shell magisk --remove-modules` as I was not able to disable the module via other way.

So far, I'm able to login to O365 apps however after e.g. 20 minutes there is some random check and O365 will log me off. Have not figured out what it causes because I can login back again straight away and it will work. I believe it is one of the LSposed module which is causing that but I can't confirm that just yet.

I'm currently using these Magisk Modules:

Call Recorder - SKVALEX 2.3.0

Fullscreen/Immersive Gestures (Q-U) 26.1

Pixelify 3.0

PlayIntegrityFix 15.9.8

Zygisk - LSposed 1.9.2

Zygisk-detach 1.15.0

Along with these LSposed Modules:

Classic Power Menu 1.7.2

Disable FLAG_SECURE 3.1.0

Hide My Applist 3.2 (Configured to hide O365 apps from the root apps)

HideMockLocation 1.2.0

ChatHeadEnabler 2.4.5

Iconify 6.7.6

ImNotADeveloper 1.0.1

LetMeDowngrade 1.0.4

XPrivacyLua 1.35 (Currently disabled)
[General Topics] vukis:
Today my teams updated and complained, that intune portal was outdated.

Went to my magisk beta Play integrity fix required update. Updated. Rebooted.

Tried my luck with updating intune and then immediately got "not compliant" :-(

So tried my luck with installing kitsune apk, open give root permissions then direct install magisk, reboot, then in kitsune settings enable MagiskHide and Enforce SuList, reboot once again.

And my device is compliant again without needing to reinstall intune portal :)

At first I thought, that going to kitsune is harder :)
[General Topics] whatsek:
I used the same settings as you, with kitsune but root is detected by the Microsoft apps. Are you using the latest intune? Or did I miss something?
[General Topics] zgfg:
AFAIK, corporate admins define Rule based Custom Compliance Policies.

Same setup on the phones - what works in one company, it may not in the other

Understanding Intune Policies

This blog post will address, and hopefully, demystify a topic I struggled with when first starting out with

www.htg.co.uk

Device compliance policies in Microsoft Intune

Overview of Microsoft Intune device compliance, including tenant-wide compliance policy settings and device compliance policies.

learn.microsoft.com

Create device compliance policies in Microsoft Intune

Create device compliance policies for Microsoft Intune.

learn.microsoft.com
[General Topics] vukis:
Latest kitsune canary
[General Topics] whatsek:
So version: 27001?
[General Topics] adinechin:
Hello everyone, as a little reminder, we have two things at play with Intune and Microsoft:

The detection of root which is managed by either Kitsune or Shamiko module on standard Magisk

The Play Integrity, which lived some changes for a lot of people in the last 48h. In fact it does not pass any more for custom roms built with android test keys. You need to ask the dev of your rom to make a new build with his own generated keys

On my side, I had to get back to a Xiaomi.eu rom on a Xiaomi device, because the LINEAGE OS I was using was not properly signed...
[General Topics] whatsek:
Figured it out. It wasn't the company portal update or kitsune, but the new (27+) update of the NavTweaks (former Fullscreen/Immersive gestures module. That triggered root detection. Switching to the latest 26.2 version passed the intune check again.
[General Topics] Jirachilover:
thankyou this worked perfectly on my pixel 6
[General Topics] WorldOfJohnboy:
Unfortunately, I was forced to update Intune Portal app (bypassed auto updates) and no matter what, I cannot get CTS to Pass. Pixel 8 Pro unlocked and rooted with stock ROM, Kernel, etc. Also updated all Magisk Modules and tried a Pixel 6 Fingerprint.

Side question: Anyone know of a more recent intune app version that will still let me use the apps and doesn't recognize root?
[General Topics] adinechin:
Could you be more specific on which root method you use (which version of Magisk), which modules, and what is in your deny list ?
[General Topics] Jirachilover:
Brimofan's instructions (kitsune mask) will hide root on the latest intune and apps