Unexpected rooted alert? I got a call from my company's Google Suite administrator that they got an alert about my phone (a Samsung S10 running Android 10) getting rooted this morning.
Google's support site isn't really helpful with this, stating only that they consider my device compromised because it's rooted.
All additional information I got about the alert is:

Summary:         An Android device was rooted. (Device ID xxxxxxxxxxxxxxxx)
Date:            Feb 12, 2020, 09:23 AM CET (2020-02-12T09:23:17+01:00)
Device owner:    firstname.lastname@company.com

As I'm pretty sure that I didn't root my company phone (especially not this morning, I was in a meeting). As I understand some apps installed can (?) root my phone, but I also don't have apps installed from untrusted sources, and I didn't install any apps in the last two days even from Google Play.
I also tried it with Root Checker, and it seems like that the phone is not rooted.
The SafetyNet Test status is

Basic Integrity: Success
CTS Profile Match: Success
Response Signature Verification: Success

Is there a way that I can check on my phone what exactly causes Google to think that the device is compromised / rooted?
I got this same thing. I have Google for business and my devices that access the business accounts are managed by the google system. It is a SM-P610 Samsung, and I have personal and work accounts on it. It alerted &quot;An Android device was rooted&quot; at 7:23AM then later at 8:32 alerted that &quot;An Android device was recovered from rooted state&quot;.
The alerts are from google.admin.com, through the Google for Business account.