[MODULE] Microsoft Intune Company Portal Hider (Intune Hider)

[mr-mauro]

Hi @aygul12345 Yes- I came up with this fix after I heard about zygisk being better at hiding root. And it seems it does.

Nice- looks like v24 of magisk now supports zygisk natively now (about time). You shouldn't need the alpha channel anymore. I can confirm things are still working on v24 Alpha (should be same as general release).

And, yes, I run the latest version of Teams/Company Portal.

Hi, what do you use as a replacement for Magisk Hyde (that was integrated till v23) in the new v24?

 

[skuppej]

Hi, what do you use as a replacement for Magisk Hyde (that was integrated till v23) in the new v24?

Hmm..in Magisk alpha I am still seeing Settings > App > Hide the Magisk app

 

[d4m4s74]

Does this plugin still work on the latest magisk/zygisk? Lookout for work keeps finding root.

 

[skuppej]

Does this plugin still work on the latest magisk/zygisk? Lookout for work keeps finding root.

No. This module is decommissioned

 

[mr-mauro]

Hmm..in Magisk alpha I am still seeing Settings > App > Hide the Magisk app

Oh yes that exist even in the final version. But I was talking about Magisk hide, to hide Magisk process to the apps. Not only the app changing the name

 

[skuppej]

Oh yes that exist even in the final version. But I was talking about Magisk hide, to hide Magisk process to the apps. Not only the app changing the name

v23 "Magisk Hide" = v24 "DenyList"

Same thing, but better.

You should also hide the app to complete the transparency.

 

[amit_coolcampus]

v23 "Magisk Hide" = v24 "DenyList"

Same thing, but better.

You should also hide the app to complete the transparency.

Not sure how is it better as both do the same thing.
Infact with deny list I cant use the xposed module ¨disable flag secure¨ for banking apps as they are in the deny list. Same is not the case using magisk hide.

 

[skuppej]

Not sure how is it better as both do the same thing.
Infact with deny list I cant use the xposed module ¨disable flag secure¨ for banking apps as they are in the deny list. Same is not the case using magisk hide.

It's more or less a rebranding, and it is zygisk that provides the lower-level access for hiding root. I have found that I no longer need to use xposed modules like XPrivacyLua to hide banking apps- Zygisk + DenyList works natively for everything that I had trouble with previously when using Magisk Hide. But xposed is still an option, if you need it. But you will probably run into issues when layering xposed modules together with DenyList for apps, yes.

 

[amit_coolcampus]

It's more or less a rebranding, and it is zygisk that provides the lower-level access for hiding root. I have found that I no longer need to use xposed modules like XPrivacyLua to hide banking apps- Zygisk + DenyList works natively for everything that I had trouble with previously when using Magisk Hide. But xposed is still an option, if you need it. But you will probably run into issues when layering xposed modules together with DenyList for apps, yes.

Xposed is not a root solution. I agree with you that zygisk works well for the same, but xposed modules are used to fulfill other purposes. Like taking screenshot in secured apps, sms code module, pixelify module etc etc.

 

[mr-mauro]

v23 "Magisk Hide" = v24 "DenyList"

Same thing, but better.

You should also hide the app to complete the transparency.

Oh wow thank you! I felt suddenly such a newbie

 

[skuppej]

Oh wow thank you! I felt suddenly such a newbie

No worries : ) I'm learning all this too. But what I do know is my method works..and I recommend u guys try it!

 

[mr-mauro]

No worries : ) I'm learning all this too. But what I do know is my method works..and I recommend u guys try it!

I'm surprised because I was always reading that MagiskHide was getting removed with the move to Zygisk... So I wasn't actually expecting it was going to be basically still there, just slightly more hidden ahaha

 

[aygul12345]

Zygisk (Alpha channel) + Magisk Hide app stting + DenyList + (MagiskHide Props Config (add fingerprint) + Universal SafetyNet Fix)

(Last two steps might not be needed but will help you pass SafetyNet.)

In denylist add Company Portal & Teams. Make sure all toggles are selected on DenyList. Then force close and clear data on both apps and sign in again. Create work profile after all is said and done, if needed.

I can confirm that this worked out! On Magisk v24.
Thanks for your clear explanation what to do and hide. I can confirm that it hide my root And passing safetynet by MagiskHide-fingerprint. +1


Steps:
Zygisk (Alpha channel) + Magisk Hide app stting + DenyList + (MagiskHide Props Config (add fingerprint) + Universal SafetyNet Fix)

(Last two steps might not be needed but will help you pass SafetyNet.)

In denylist add Company Portal & Teams. Make sure all toggles are selected on DenyList. Then force close and clear data on both apps and sign in again. Create work profile after all is said and done, if needed.

 

[aygul12345]

Hi @aygul12345 Yes- I came up with this fix after I heard about zygisk being better at hiding root. And it seems it does.

Nice- looks like v24 of magisk now supports zygisk natively now (about time). You shouldn't need the alpha channel anymore. I can confirm things are still working on v24 Alpha (should be same as general release).

And, yes, I run the latest version of Teams/Company Portal.

Yes, Im happy that you described the steps and how and what need to hide completely.
Could you tell me what to do when there is a OTA update of the phone?

Which steps need to follow to keep/maintane the root of the phone when there is a OTA firmware update of the phone?

 

[skuppej]

Yes, Im happy that you described the steps and how and what need to hide completely.
Could you tell me what to do when there is a OTA update of the phone?

Which steps need to follow to keep/maintane the root of the phone when there is a OTA firmware update of the phone?

I'd say that this is a different discussion entirely- I don't really advise taking OTA updates (which, depending on your device, can upgrade your BL and render it impossible to gain root afterwards going forward), and I would instead stick with custom rom updates like LineageOS or AICP, for instance. But, regardless, you will need to have Magisk v24+ installed always. If you can manage to keep Magisk going on OFW then more power to you.

As for app updates (Teams/Company Portal), you can let these update to the latest. They should continue working until Microsoft finds a new way to detect root, which will eventually happen.

 

[aygul12345]

I'd say that this is a different discussion entirely- I don't really advise taking OTA updates (which, depending on your device, can upgrade your BL and render it impossible to gain root afterwards going forward), and I would instead stick with custom rom updates like LineageOS or AICP, for instance. But, regardless, you will need to have Magisk v24+ installed always. If you can manage to keep Magisk going on OFW then more power to you.

As for app updates (Teams/Company Portal), you can let these update to the latest. They should continue working until Microsoft finds a new way to detect root, which will eventually happen.

Im curently running a Xiaomi phone with a Global ROM official. I get that.

My question is more, what if there is a OTA coming out. What are the steps to do? Because Installing OTA flash the recovery back to stock. So that I lose Magisk. What is best step to take on?

- Install the OTA
- Before Reboot, install Magisk?
-...
-..

 

[skuppej]

Im curently running a Xiaomi phone with a Global ROM official. I get that.

My question is more, what if there is a OTA coming out. What are the steps to do? Because Installing OTA flash the recovery back to stock. So that I lose Magisk. What is best step to take on?

- Install the OTA
- Before Reboot, install Magisk?
-...
-..

Not sure man- never worked with Xiaomi/GlobalRom. But typically you would want to remove magisk first, dirty flash the new ROM (or take OTA..), then reinstall magisk. But definitely check the Xiaomi forum/GlobalRom thread for their suggestions.

 

[skuppej]

Personally, I don't ever really take rom updates or OTAs or dirty flash. I always let it go.. and then maybe once a year perform I will back everything up and perform a 100% clean rom re-installation with the latest version available. Usually results in less problems.

 

[dejson]

I can say that yesterday I have unlocked bootloader and installed MIUI GO PLUS on my POCO X3 PRO, installed last Magisk 24, hide magisk from apps. Enabled zygisk. Installed fix for cts passing, even you dont have to at all. I deny my banking app in the list and it is working like a charm. I am working in a bank and was too scared to try intune, because if it fail, I will be reported. But I am sure that this method is working 100%.

 

[Zvhdd]

Hello Everyone,

Hope you are well. I work for said company who produces Intune and Defender. A moment ago, I successfully bypassed Intune Company Portal. I full access to email, SharePoint sites, Teams, Outlook, Azure, Identity Protection, Defender, Service Hub, etc, all with Magisk Hide only. Apologies I cannot show my Email nor my Teams for verification, as I am a security engineer for said company.

****MAKE SURE TO HIDE ALL OF THE CHOICES I HAVE LISTED (IF YOU DONT USE IT, DONT DOWNLOAD IT)****

Make sure you do not open any of the initial app installs, and make sure all trades of your original attempts with Intune are wiped with Cache and Data.

MagiskHide (I named mine HideMe) all of the apps you are hiding. Even if you don't see the Company Installed apps after initially attempting the setup, the fact you have the apps installed and hidden PRIOR TO SETTING UP INTUNE, will insure that you get ALL paths.

All current with the latest Intune updated and Magisk on Stable Repo. Please pm if you have any questions. Happy to help, though I work off hours, but I will respond.

Please see the screenshots for verification. Cheers.

This is current as of 11/10/2021.

**Edit: This was done using a rooted OnePlus 7Pro 5G Sprint Rebranded to EU, running 10.14. with Magisk and TWRP Recovery installed***

I tried multiple times but still can't pass. Could you please advise if any mistake made in my attempts?
Device: Oneplus 6 stock rom (Android 10) with Magisk 24.1 in Zygisk and Shamiko module enabled.
I used Shamiko because DenyList is not enough for some bank apps.
It can pass Root Beer test for root and YASNAC for SafetyNet.

1. Install Teams and Intune from GooglePlay
2. Force stop and clear data/cache for both apps
3. Add them into DenyList
4. Reboot (for Shamiko to take effect)
5. Start Teams and try to login
   (My company's policy is that you cannot enroll your own device, but just rely on Intune to verify your device is relatively "Safe")
6. Teams can login but Intune will prompt that you device is rooted and ask to remove account.