[Google Pixel 6 Pro] Guzzlor:
HI all. Keep in mind that I did my first root and install of Magisk this week for some gaming desires. I am a bit of a noob, but I had a blast learning about rooting. I was also encouraged because everything went pretty well and only took me around an hour.

Then I ran into a wall.

I use my Pixel 6 Pro to attend work meetings and track work form home or in my car. I had really grown to need this feature so I was a bit worried that I would have to reverse the root. So for the last 2-3 days I have been using trial and error and guides on how to hide banking apps. I saw so many threads that never resolved the teams issue or missed steps that I thought I would write up a detailed guide for what worked for me.

Keep in mind this is for Android 13 and a Google Pixel 6 Pro. This assumes you Rooted your phone and have latest Magisk installed as well.

Prep:

1. Go to Google Play Store settings and turn off automatic updating. I'm sure most people who use magisk do this anyway.

2. Go here https://en.uptodown.com/android/browsing and download older versions of Teams and Company portal. Not too old. You want something from just 2-3 months ago. If it is too old the phone won't let you install it but will put files on your phone that already know you're rooted.

3. Make sure you have the latest Universal Safty fix. You can run a scan to show if you meet the safety fix standard. Again I think the problem isn't safty fix so much as Company portal looks for an unlocked boot loader.

4. install Mgiskhide Props Config module and Android terminal from the play store. (You do this to put a legit looking device ID, or non unlocked bootloader ID - just encase your phone doesn't work, or has been previously detected). Its a simple process where you input some number options through android terminal to set the ID. Just follow the steps. AND MAKE SURE YOU DELETE TERMINAL AFTER YOU'RE DONE. They look for that.

GitHub - Magisk-Modules-Repo/MagiskHidePropsConf: This tool is now dead...

This tool is now dead... Contribute to Magisk-Modules-Repo/MagiskHidePropsConf development by creating an account on GitHub.

github.com

5. Use Magisk hide and rename Magisk to MYJOBSUCKS

Action:

1. install Shamiko https://github.com/LSPosed/LSPosed.github.io/releases/tag/shamiko-120

2. Reboot.

3. Make sure Zygisk is enabled.

4. Make sure Enforce Denylist is OFF (This seems nonsensical but Shamiko handles the enforcement now that it's installed. The Zygisk enforcement is a conflict.)

5. Go back and install Company portal and Teams. Don't do anything in either. Don't sign in. Don't configure. Don't open the apps.

6. Go back to Zygisk and open Configure Denylist. This, I feel, is the MOST important step that makes or breaks this process. Do the following in Denylist:

MAKE SURE YOU TOGGLE EVERYTHING not just the default hides. Each hide has a submenu and for sub processes to hide.

This is everything I had to deny to make it work:

Authenticator.

Carrier OMADM

Carrier provision service

Carrier services

Certificate installer

Com.andorid.angle

Companion device manager

device health service adaptor

device policy

Gpay

OemDMTrigger

Permission controller

TEAMS

Work setup

Company portal

Google play protect services

Google Play Store

*** I Believes the bottom 5 are the main ones - the rest I just guessed and may or may not impact things 100% *****

7. Sign into Teams.

8. This will force you to sign into Company portal. If it works - not much will happen because it will look like a legit non-rooted phone.

If it fails you'll have to setup your profile in Company portal and it always fails after a 5 step process and says DEVICE NOT HEALTHY) This means you didn't deny something or you didn't reboot or something. You also need to go into your google accounts and look for your work profile and delete it and uninstall teams and company portal - I think company portal leaves files that you want off so you have to start from scratch)

9. You should be able to join your work meetings and use teams.

Ongoing:

Make sure you never update teams or Company Portal.

I don't know if this works for other MS mobile apps because I don't check my mail on my phone - but I assume just adding them to the deny list would be the only step extra you need to take.

Thanks!!