Rooted device(s) are detected in the network - False positive?

Rooted device(s) are detected in the network - False positive?

I have been getting this alert for a few weeks now for two of our users. It happened once for one user, and intermittently for the other. I have inspected both devices thoroughly. They are certainly not rooted, so there must be something else going on. What is the exact criteria for how ME MDM determines a device as being rooted? What could trigger a false positive?
                New to ADManager Plus?

                  New to ADSelfService Plus?