yashsingh1/xdaforums huggingface dataset:
[General Topics] dkannegi:
You could try using AFWall+ and and block Google Play and Play services over all modes, and then see if Company Portal still sneaks in its auto-update. I also found that 'Edge' and 'Office' apps contributed the most to tripping root detection (in fact - 'Office' does not work period - it 100% detects and sets off the 'alarm' to all other M$ apps - whereas Teams, Word, Sharepoint, etc tunnel thru Company Portal). It seems that the M$ apps work together in conjunction with Company Portal to contribute to the root detection picture - and something especially crazy with 'Edge' and 'Office'.
[General Topics] James wick:
Download the ZIP and install it as a module in Magisk (24.1 or higher).

- Reboot again and restart the YASNAC

- Yet Another SafetyNet Attestation Checker.

- It should now pass (at least) the Basic integration.

- Now your Microsoft Apps should work.
[General Topics] joegreat:
Nope - does NOT work on my Device OnePlus 7T (HD1903) - after some time (even a day) M$ detects root and stops working.. o_O

By the way: Any news regarding the stickiness problem of some apps in Magisk?

Update: Looks like the culprit is that the Magisk app is detected - shown via TB Checker "Run Exposed Check" (see attached screenshot).

Update 2: @rseiler @zgfg Thanks for the Intune hint! Removing Intune made it work also for me! (y)

Update 3: But the solution from update 2 does not work for long - overnight Outlook stopped working - only a reboot make it work again. :confused: The culprit is explained here - not sure the "solution" works, but I will give it a try!

Update 4: The solution posted by @dtkent worked overnight - looks like this is the final solution (until M$ finds another trick to spot root)! :love:
[General Topics] Searinox_Navras:
My phone passes TB Checker and HMA's test app as well as root checks on several other apps known to have detection, yet any previous cersion of Teams and ICP, even detached from the store with Google not seeing them installed and offering to install them, still detects root within seconds of logging into Teams. The device is not healthy and the ice cream has gone SPLAT on the sidewalk! :(
[General Topics] sigfy01:
Indeed, the store seems to bypass the detach process at some point.

I solved this by using an automation app to trigger the install of the Detach3 script every 30 minutes with below command:

su magisk --install-module /sdcard/detach-3.01.zip

I've been using this method for more than 1 year to make sure Youtube is never updated and it never failed me.

I personally use MacroDroid, but you should be able to use Tasker or any automation app.
[General Topics] alberto88a:
I think the 3.0 only works with pla pre-defined list of apps...to add custom app not present in the original list I'm currently using v5.3

Great idea the 30m trigger, thanks 🙏
[General Topics] sixtybi:
What I did, to prevent being auto updated, I charge my phone while wifi is turned off. I realized it is being updated (even if I use detach), while charging and one wifi. So this is my workaround. Working for a week now.
[General Topics] sigfy01:
You can add custom apps with v3, it's just that the file is a bit different and has to be placed in a different location.

But anyway, both should work.
[General Topics] alberto88a:
Thank you. Any recommendation for an app doing the Cron job?

Thanks
[General Topics] dtkent:
Perhaps this is the cause of our Intune frustrations?

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-1-1-0.4217823/post-87188299
[General Topics] sigfy01:
None strictly dedicated to cron jobs, but I've been using Macrodroid for quite some time now for various automations, and it allows triggers by time periods and script execution.

I'm pretty sure Tasker is able to do the same.
[General Topics] dtkent:
Alright, I'm fairly confident now the problem seems to be the new Play Integrity API from Google, and not some nefarious new root tracking method from MS, which makes a lot more sense.

More info on PI API here: https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/page-90#post-87188299

Basically what is happening is that GMS is checking for the highest level of system integrity available on your phone. If your phone fingerprint (model+OS) supports hardware-backed authentication, the check will fail if that isn't returned intact. If your phone only supports software-level integrity checking, that is what gets returned.

It appears Company Portal is now checking for Play Integrity, and many more root-secure apps, like your banking ones, are sure to follow.

@Displax published a USNF mod that injects an old Pixel XL fingerprint into GMS using Zygisk which avoids changing global props and causing issues elsewhere: https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87198517.

Usage:

1. Delete/disable/reset MagiskHidePropsConfig (if installed).

2. Just install it over old Universal SafetyNet Fix and reboot device.

This means PI API will sign off on device integrity at the software level, which you can check using the Play Integrity API Checker from @1nikolas: https://xdaforums.com/t/discussion-...cussion-thread.3906703/page-130#post-87182459. A more in-depth version that also checks for hardware-backed authentication should be available in the Play Store soon.

On *top* of all this, it seems Company Portal was detecting the zygisk process in memory. Shamiko 0.5.2 seems to block this by also hiding the zygisk process. HMA doesn't seem to be necessary so far but I'm monitoring.

Doing this my phone has been stable on Company Portal 5.0.556.0 for over 24h through reboot and overnight charge.

It's not clear yet how fragile Displax's USNF mod solution will be, hopefully this issue will be incorporated into future USNF releases. But absolute hardware-backed checks may be only a few years down the line and will likely make hiding root near impossible.

Hope this helps some others.
[General Topics] anandpandey:
It seems to be resolved with yesterday's update of Shamiko to 0.5.2

After yesterday's update the settings are working fine. Will update in case the issue resurface.
[General Topics] joegreat:
Download from Github: https://github.com/LSPosed/LSPosed.github.io/releases - just in case somebody is searching for it as I did... :cool:
[General Topics] alberto88a:
In the end I used crontab on termux...seems to work fine until now :)
[General Topics] BrimoFan123:
I have installed Universal SafetyNet Fix MOD by Displax: https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87198517

Then:

I have rebooted my phone,

installed Shamiko module https://github.com/LSPosed/LSPosed.github.io/releases

Rebooted again

Outlook seems to work... lets see in couple of days if it would discover my phone is rooted.

But in Magisk Modules I see:
[General Topics] ywlke:
Hmm so I reflashed my device with an Android 12 ROM (crDroid 8.7 on OP7T/hotdogb) and reinstalled Company Portal and Work Profile from scratch. I followed the steps above (running Shamiko 0.5.2, using the modded USNF, adding items to denylist but not enforcing, even renamed the Magisk app), both YASNAC and the Play Integrity Checker are giving me a pass, and even Wallet allowed me to add a card (haven't tried paying yet), but Company Portal still detects root...any ideas?

Tried with both Company Portal 5.0.5472.0 and 5.0.5585.0.
[General Topics] BrimoFan123:
The same here. After all these steps done at first Outlook worked but few hours later suddenly detected root.

What seems to be as a kind of workaround is to uncheck Outlook and Company Portal from deny list in Magisk and then select once again each component separately as advised above - then Outlook eventually start working up to next root detection.

Sad there is no permanent solution.
[General Topics] ywlke:
After more tinkering I think I found what I was doing wrong. I'd never noticed before that adding items to MagiskHide and now Deny List wasn't enabling all possible subcomponents, and the grey in the UI suggested to me that the additional subcomponents weren't enabled because they couldn't be enabled, but in fact they can if you manually tap the toggle. An easier way though is if I expand the apps components and then enable it in Deny List, it enables all subcomponents too, and when I did that root wasn't detected even on the latest version of Company Portal. I only have to deny/Shamiko the Company Portal app; Outlook and Office seem to work fine without being explicitly added to the list.
[General Topics] BrimoFan123:
No. It is not a permanent "fix"

I have reported that in my previous message that I have toggled (enabled) each Outlook and Company Portal's sub component in Deny List.

Once I did that Outlook worked for a while but then suddenly root was detected.

For me a partially working workaround how to hide root from Outlook is to disable each sub component, then enable it again and SOMETIMES it cause that Outlook is start working until again root it is detected.
[General Topics] ywlke:
Must be due to different hardware then. Mine continues to work despite Outlook revalidating security every couple launches.
[General Topics] dtkent:
You have to 'disable' the Enforce Denylist slider in Magisk settings so that Zygisk is not applying Denylist, as the Zygisk process can be detected by apps. Shamiko will enforce denylist but also hide the zygisk process. Disabling the switch let's Shamiko do it's magic.
[General Topics] BrimoFan123:
Yep... did that and lets see in coming days if Outlook will work with root not being detected :)
[General Topics] WorldOfJohnboy:
I have the latest Microsoft Apps and Magisk installed and was getting the compromised device notification. After installing Shamiko and disabling the DenyList for Zygisk, everything is running normal. Good thing, too as I'm on call this week.
[General Topics] Masquatch:
Thanks, this combo is working for me (for now...)
[General Topics] BrimoFan123:
Yes, I can confirm the same: so far no root detected by MS apps and Outlook & Teams just open.

Thanks a lot to all who made it possible to launch MS apps on rooted devices.

Now we need to wait for next MS updates that will cause it will stop working and response from xda developers :)

This is never ending "war" :)
[General Topics] Trialer03:
I have installed Universal SafetyNet Fix MOD by Displax - - >Google Wallet work fine...

I have installed Shamiko module and than 'disable' the Enforce Denylist slider in Magisk settings. Adding all the MS Apps to the list... But Outlook and Teams doesn't work... 😬 Do you have any idea ?
[General Topics] BrimoFan123:
Did you expand each of MS apps and select each sub-component as advised above?

If so and it still doesn't work then try to clear cache while in Flight Mode, reboot and then back from Flight Mode to WiFi. If still no luck then repeat with clearing data for MS apps.
[General Topics] Trialer03:
Yes I have expand the apps...

I clear the data of the Apps in Flight mode... Reboot and it still doesn't work 😕
[General Topics] BrimoFan123:
What do you mean by doesn't work?

Does it generate a warning that root is detected once you launch Outlook or some other issue?

If you are getting root detection with Shamiko module and Deny List not enabled then it is weird as apparently it works for other people including me.
[General Topics] Trialer03:
Yes it´s generate a warning that root is detected by Outlook.
[General Topics] BrimoFan123:
Try to clear cache and / or data for Google Play Services

According to: https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87249049

"Pay/Wallet only relies on Google Play Services"
[General Topics] Trialer03:
I have hide Magisk app in the settings. This works...
[General Topics] BrimoFan123:
This is the third bullet in the steps needed to perform.

Next time do exactly what is provided before reporting an issue.
[General Topics] robert1968:
Many Many thanks for this explanation.

It works for me. Poco F2 Pro with Lineage OS 19
[General Topics] robert1968:
Thanks for the links and Pay my attention to disable enforce deny list !

works now!! :)
[General Topics] digger16309:
I upgraded to A13 on my Pixel 5. Restored apps (TEAMS and InTune) crashed and wouldn't work with old data. I have Zygisk enabled, forced deny list through Shamiko, everything checked in InTune and TEAMS, Magisk 25.2 hidden, USNF 2.3.1-mod loaded, YASNAC passes. I have a pin lock active. InTune fails when trying to take me to my company's SSO page inside the app. It comes up for a moment and then says "Missing Certificate". It directs me to grant access to the browser from the app settings but there is no setting to do that. I'm stumped. What am I missing?
[General Topics] ldeveraux:
Now getting a 'custom OS is installed' warning when I try to install work profile in Company Portal. Anyone else still having issues?
[General Topics] digger16309:
Sorry to quote myself, but to follow-up...what I was missing was that AdAway was blocking my SSO page from coming up in InTune. When I turned off AdAway, I was no longer blocked.
[General Topics] vrtsvas:
Guys Hello to everyone,

I have rooted my S22 ULTRA SM-908E snapdragon and i face the same problem for

1. Microsoft Teams vs:1416/1.0.0.2022354201

2. Company Portal vs: 5.0.5606.0

3.Samsung Health vs 6.22.2.007

I HAVE FOLLOWED EXACTLY THE FOLLOWING STEPS BELOW HIERARCHICALLY:

1. i have succesfully rooted my s22 ultra and running latest version of Magisk App vs:25.2 (25200(33)

which was installed after having patched the file and then flash everything with ODIN and updated again once i setup the phone from scratch and also updated the Magisk 25.2.(25200)

2. then Hide the magisk app and renamed it to "BB"

3. then enabled Zygisk

4. then enable EnforceDenyList

5. Then rebooted and after reboot i installed the following modules

6. Installed Module MagiskHide Props Config vs:6.1.2-v137 by Didgeridoohan ( this is the latest NOV 9 2021, I CANNOT FIND ANYTHING UPDATED AFTER THAT IN -->https://github.com/Magisk-Modules-Repo/MagiskHidePropsConf/releases?page=1) reboot and then

7. installed Universal SafetyNet Fix v2.2.1 by kdrag0n then reboot

8. Installed Module Zygisk-LSPosed v.1.8.3 (6552) by LSPosed developers, then reboot

9. Then i installed Microsoft Teams vs:1416/1.0.0.2022354201 & Company Portal vs: 5.0.5606.0 & Samsung Health vs 6.22.2.007

9. Then i came to the part its being discussed in this forum to ConfigureDenyList and i have mediculesly checked all the boxes to include all the above apps and guess what they are all FAILING ! LOL

I thought maybe someone has any workaround and if there is anything i can do , cause i cannot use these app which are necessary in my daily to daily activities. Please for your inputs and thoughts

Have a good one

Cheers
[General Topics] digger16309:
I didn't see this in your list:

Shamiko hides Zygisk and takes over the deny list.

Also make sure you have a pin or password lock active and no ad blocker running.

Clear data on the apps, reboot and try again.
[General Topics] vrtsvas:
i have shamiko as well i have tried with both either enforce deny list and shamiko and have cleared the data from the apps and cache and still the same story , nothing bypasses and nothing work, the worst thing of all is that day by day i am discovering that other applications don't wotk like netflix outlook and more, any thoughts ?
[General Topics] alberto88a:
I'm still with an older version of Company Portal and a crontab to flash the magisk module to detach it from the PlayStore to avoid the auto-update..

For now it's working, but at one point Teams and Outlook won't work anymore with a not updated MSFT intune...
[General Topics] Zranz:
Is it that the newest versions of company portal detect root even with the above steps? I have tried to connect to the Company Portal with the USNF mod, Shamiko modules, Company Portal in denied list, Magisk hidden... and no success after repeated reboots and cache clears. My bank accounts work, and so does Netflix and paying with Google Wallet. Any new instructions? Anyone experiencing being blocked with the new versions of company portal too?

I tried downloading an old apk from July of Company Portal, but I still did not manage to connect. Can you be more specific @alberto88a how you did install it?
[General Topics] Jirachilover:
Alright.

You need

1) Shamiko mod (remember to disable enforce denylist) - am using 0.5.2

2) magisk - which I personally updated to 25.2

3) Universal Safetynet fix - it needs to be the 2.3.1 which is modded by Displax

Check YASNAC

My YASNAC passes Basic Integrity and CTS profile match and has BASIC evaluation type.

I check the Play Integrity checker. It MEETS_DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY

In magisk, Company Portal is in the Configure Deny List, Teams and any other microsoft app needs to be fully configured to enable every component (you can expand the menu items by clicking the name of the application).

I am on the latest company portal and teams and stuff and it's working
[General Topics] Jirachilover:
make sure the universal safetynet is Displax' 2.3.1 as safetynet is gradually being replaced by play integrity
[General Topics] Jirachilover:
you need to disable the MagiskHide props config and install the newest version of USNF https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/page-91#post-87198517
[General Topics] deep_raman:
Thanks dude, this method is working for me as well. Cheers :)
[General Topics] Zranz:
It still does not work for me. I am using Displax' 2.3.1 USFN, I also reset and disabled MagiskHide props. I install company portal from play store, add it to deny list, Shamiko 0.5.2 says it's blocking. I then reboot, try to sign in and I am denied entry. I am using a Oneplus 6 on LOS 19.1. I have read in forums that Oneplus devices had issues when logging company portal with Android 12, something related to their firmware. Could it be related?
[General Topics] digger16309:
You could test that by unrooting right? Also disable ad blockers when signing into Intune and make sure you have a pin lock active.
[General Topics] Jirachilover:
The normal error message you'll receive if you can't get intune and the microsoft apps to play nice with your root is that your device is non compliant/rooted with a popup every time you try and open teams, outlook etc. If you have issues with signing in it might be another problem (did do a search around the oppo thing and saw people have issues but I'm not sure)
[General Topics] baliku:
Samsung S20U LDU, Android 11

Magisk 24.3

Magisk Modules (latest):

Magiskhide Props Config,

Shamiko,

Universal SafetyNetFix

Zygisk = On,

Enforce DenyList = Off

DenyList ((WITH ALL SUBCOMPONENTS: blue line over app name should be full!) :

Company Portal,

Google Play store,

Google Services Framework (does not have chekmark, because it is known Magisk bug)),

Teams

Magisk itself is renamed: app name changed

App data for Intune and Teams is cleared

YASNAC: BASIC, integrity and CTS passed

Play Integrity checker: MEETS_DEVICE_INTEGRITY, MEETS_BASIC_INTEGRITY passed, MEETS_STRONG_INTEGRITY failed (because its impossible for rooted device)

Intune Company Portal 5.0.5519.0 manually installed from ApkPure

this helps for me. Teams now work
[General Topics] undert0w:
Did you disable Enforce DenyList in Magisk settings?
[General Topics] Zranz:
Yes, I did disable Enforce DenyList in Magisk. Shamiko reports it is working as a blacklist mode.

This is the report about the required firmware update that affected OnePlus, Oppo and Realme that I mentioned above. Not sure if such firmware changes should be ported to our devices somehow. My phone never received Android 12 nor receiving updates anymore. I imagine I could try install a lower version of LOS and try again to test this hypothesis.

If there are other people affected with phones from those brands that would be insightful too.
[General Topics] undert0w:
I'm on P4A with stock A13, sorry 😅
[General Topics] dtkent:
Sigh.... back to MS Apps in my work profile detecting root after months of working well. CP updated last night to 5.0.5616.0.

Current setup:

1. Android 13

2. Magisk 25.2

3. Shamiko 0.5.2

4. USNF 2.3.1-Displax mod

Denylist is off for Shamiko and all MS Apps + usual suspects are hidden.

As before, it exhibits strange behavior where the CP signs off on my phone, but MS Apps immediately detect root.

I tried to install HMA thinking that might help, but the module bootlooped me and I had to dirty flash stock boot and then reinstall Magisk. Not necessarily inclined to try it again without knowing HMA might be a particular solution.

I can't roll back to earlier CP versions as the work profile version of the Play Store blocks turning off auto updates.

Any insights are appreciated...
[General Topics] digger16309:
I don't see this in your setup - is Magisk hidden? That is a key parameter for me with MS Apps.

Others may be running that CP version successfully but that might be the lynchpin. I don't have work profile. Can you / Have you cleared all data in your CP and Work apps, then uninstall all and reboot, reinstall all, check them all off in deny list and reboot, then try?

Are you running a custom ROM or stock ROM?
[General Topics] dtkent:
Yes absolutely, sorry, Magisk is hidden and always has been. Stock ROM. Clearing data (in fact, reinstalling entire work profile) makes no difference.

Interestingly, CP has never seemed to have any 'memory' of root with prior fixes, I've noticed. When I've previously found a fix (like Shamiko 0.5.2) CP instantly stopped catching root without the need for memory cleaning, reinstalling work profiles, etc. But I've tried it here just to see, and it's been no help.
[General Topics] Olorin92:
Wondering if anyone might be able to help me here...

I've followed the steps from the more recent posts in an attempt to get CP working. As it stands, I have the Displax USNF, Deny list is disabled, I have the latest Shamiko installed, all Microsoft apps are hidden in the deny list and I'm running Android 12 on a Pixel 6 Pro.

No matter what I do, every time I try and setup the company portal, I get the message that my device is compromised. Magisk is also hidden, and I've removed magisk props too. Any ideas what's going on here? Pulling my hair out trying to get this to work, as everyone else seems to be successful, just refuses to work for me
[General Topics] digger16309:
Do you have Magisk hidden? Are you running the older version of Intune - version 5.0.5541.0? Are you running any ad blockers? Other apps CP may detect? Custom ROM?

I have a P6P and it worked for me on A12 and now A13 but I'm running stock ROM and that specific version of CP.
[General Topics] Olorin92:
Yes to Magisk hidden and running old version, no to ad blocker, apps CP can detect or a custom ROM.

Just have no idea why it refuses to work and how it's continually able to detect that I'm rooted (despite every other app being fine, including banking apps)
[General Topics] undert0w:
Same here, starting today.
[General Topics] digger16309:
Are you running LSPosed?

The thing to do, potentially, if you have the stomach for it, it back up all your apps and data, then flash the current stock ROM with a wipe.

Root, and do your setup with Magisk hide, Shamiko, deny list etc... Bring back the correct (old) version CP and your MS apps, but without restoring data, blocked in Deny List, reboot.

If CP is still detecting root, it's likely something your company has done on their side of CP (and we're all going to get hosed when whatever that is spreads). If it doesn't, then it's probably looking for and detecting an app that has root access.

A dirty way of doing this is to remove/disable/freeze all apps that normally have superuser access rights granted.

Since HMA is no longer supported, that may or may not be an option as well.