[General Topics] FrogMaster-:
I keep seeing this question asked frequently; While there are threads available with relevant information the OP is no longer up to date and has not been updated in nearly a year. Due to this I've opted to create a new thread to explain the latest method for bypassing Microsoft Intune / Company Portal Root checks.

The Question:

How do I get Magisk to work with Microsoft Apps like Microsoft Teams, Microsoft Outlook etc (protected by Microsoft Intune)?

Confirmed Working With Company Portal Version: 5.0.6239.0

There is now zygisk detection checks that have been added as of Company Portal Version 5.0.6173.0. It is now critical to disable the internal zygisk and use Zygisk Next.

Alternative root methods such as Magisk Kitsune or KernelSU(with Shamiko and Zygisk Next) remain undetected if configured correctly as the Zygisk implementation is done with ptrace.

Requirements:

The latest Magisk version

Magisk Module: Shamiko

Magisk Module: Zygisk Next

Magisk Module: Play Integrity Fix (Fork)

autopif.sh (Pulls the latest Xiaomi Fingerprint)

LSPosed

LSPosed App: Hide My AppList

NOTE: I assume I don't have to explain how to install Magisk Modules, the tutorial below expects you've already installed the above mentioned requirements. If you ask me how to install a Magisk Module I will refer you to the original Magisk or Module documentation.

The Answer:

1) Magisk Configurations:

Open the Magisk Manager app

Navigate to: Settings > Hide the Magisk app: Select a new name of your choice (I use 'Mgsk' though something less descriptive is generally better to avoid detection.)

Enable Zygisk: Settings > Zygisk (Make sure it's Enabled/Toggled On)

Uncheck Force Denylist in the Magisk settings

Select 'Configure DenyList'

Use the magnifying glass and search for "Microsoft".

You must add "Company Portal" (also known as Microsoft Intune) and

ANY Microsoft applications you're using.

(Teams, Outlook, ETC...)

EXTREMELY IMPORTANT:

When you're adding these applications to the Denylist make sure you click the app name and ensure all the apps package names are checked for the denylist. If you do not expand the app and select all packages you will not be completely hiding root from these applications.

REPEATING IMPORTANT INFO:

All Microsoft apps must be added to the deny list (Microsoft Teams, Microsoft Outlook, ETC...)

Spoiler content hidden.

Disable Zygisk: Settings > Zygisk (Make sure it's Disabled/Toggled Off).

Zygisk Next will handle everything necessary for Zygisk and respect the configured Deny List.

If you want to add additional apps to the Deny List you will need to temporarily re-enable Zygisk within Magisk

Reboot your device to fully disable Magisk's internal zygisk

Navigate to your Magisk Module List > Confirm Shamiko indicates: "[😋 Shamiko is working as blacklist mode]"

Spoiler content hidden.

2) Pass Device Integrity (Play Integrity API)

After installing PlayIntegrityFix (Fork) you will need to locate a valid fingerprint that passes Device Integrity. You will either need to search manually for a fingerprint, or use autopif.sh (Pulls the latest Xiaomi Fingerprint). Instructions on how to use this tool are documented within the thread.

Passing Play Integrity / Device Integrity is covered widely in the PlayIntegrityFix Thread. Please keep any discussions about passing Play Integrity and Device Integrity in the PlayIntegrityFix Thread

You can validate if you're passing Device Integrity with Play Integrity Checker, TB Checker, Simple Play Integrity Checker or Google Play Store's developer options section.

3) Hide My Applist configuration

NOTE: Company Portal has built in checks to verify if certain packages are installed, if they are it uses this as a form of security check.

Create a blacklist template that contains all your root applications (Magisk, Hide My Applist, ETC)

Apply this template to Company Portal, Teams and Any other Microsoft applications you're using.

Settings > Data Isolation > Enable Vold app data isolation

Settings > Data Isolation > Disable Enforce data isolation for all apps

Hide any of the packages on the below list from Company Portal if you have them installed.

Spoiler content hidden.

4) Clear Storage/Cache Data From Company Portal / Microsoft Apps

Make sure to navigate to your Settings > Apps and clear the Storage / Cache for both Company Portal and any Microsoft Applications you're using.

5) Disable Automatic Google Play Store Updates for Company Portal

Google Play Store > Intune Company Portal > Three Dots > Uncheck Enable auto update

Seriously, you should do this, and only update Company Portal when absolutely necessary. Microsoft is constantly improving the root checks in the Company Portal application.