We are working on a screen capture app. I have provisioning setup for a developer id certificate for do direct distribution and a distribution certificate for Mac Store distribution; I submitted the app to the store with the distribution certificate provisioning active. We need to add documentation so while we are waiting, we decided to distribute the app directly and this is where the problems come in. I made the developer id certificate and archive->exported the app. Then I manually stapled the app with "xcrun stapler staple Madshot360.app". I created a dmg file with the exported app. The problems are; The app captures screen area with ScreenCaptureKit. A prior version of the app used a development certificate. When a user runs this new developer id cert app. the macos gets confused because it doesn't connect the new version to the already permissioned older app version. The user has to manually delete the old permission and then restart the app so the new version creates a new record which can then be enabled. This is confusing for the user since the permission says the app is enabled but it really isn't. We experimented with IT using a command line to delete the old app permission. That did not remove the old permission but now the user can't delete this record at all. What can I do to force the removal of a permission that is broken. The command we ran was this. "sudo tccutil reset ScreenCapture com.madwire.Madshot360" The app used to display it's normal warning that screen recording needed the users permission. This is the permission I talk about above. Now there is a second permission screen that states the following; "Madshot360" is requesting to bypass the system private window picker and directly access your screen and audio. This will allow Madshot360 to record your screen and system audio, including personal or sensitive information that may be visible or audible. Allow, Open System Settings. This is basically what the normal alert does. Why the second window and how can I stop it from appearing when the user has already allowed it. Is it because the binary is distributed directly from my computer? Summary: What can I do when a permission is broken? Is there a command that IT can use to remove any old permissions before installing the app. This app is to be used internally. Is there a command line that will remove a specific app's permission before installing the app? Remember, the command line I showed you basically further broke the permissions for this app. What is causing this second warning dialog to be displayed?

Hi All. I'm working on Single-Sign-On feature in my application to let customers sign into their TV Provider. I need to add Video Subscriber SSO entitlement (com.apple.developer.video-subscriber-single-sign-on) to the app, but I found out that it's a special entitlement, need to contact Apple to enable it for my Apple account. On https://developer.apple.com/account I navigated to Support -> Contact Us -> Development and Technical -> Entitlements and ask in the email about missing entitlement (ticket ID 102478794279). The support team couldn't help me, they redirected me to the operations team. I've been waiting for a few months now but they inform me to keep waiting. Is there a better way to contact Apple and get Video Subscriber SSO entitlement in an efficient way?

We have a Mac app that uses some restricted macOS entitlements, thus to test it we embed a development provisioning profile, that needs to contain the correct provisioning UDID. Typically, for test VMs, we extract the provisioning and UDID and add it to the developer portal and then re-generate the provisioning profiles. However when we try to do this in our newly created VM (Apple Silicon), our executable won't run, and macOS logs that the provisioning profile doesn't allow the device: 2025-06-12 12:37:52.168 E taskgated-helper[27489:e97da] [com.apple.ManagedClient:ProvisioningProfiles] embedded provisioning profile not valid: file:///Applications/foo.app/Contents/embedded.provisionprofile error: Error Domain=CPProfileManager Code=-212 "Provisioning profile does not allow this device." UserInfo={NSLocalizedDescription=Provisioning profile does not allow this device.} 2025-06-12 12:37:52.169 E taskgated-helper[27489:e97da] [com.apple.ManagedClient:ProvisioningProfiles] Disallowing com.company.foo because no eligible provisioning profiles found 2025-06-12 12:37:52.169 Df amfid[112:e99b0] [com.apple.xpc:connection] [0xb34c74a00] invalidated because the current process cancelled the connection by calling xpc_connection_cancel() 2025-06-12 12:37:52.169 Df taskgated-helper[27489:e97da] [com.apple.xpc:connection] [0x839144000] invalidated because the client process (pid 112) either cancelled the connection or exited 2025-06-12 12:37:52.169 E amfid[112:e91ac] [com.apple.MobileFileIntegrity.framework:default] Failure validating against provisioning profiles: <private> 2025-06-12 12:37:52.169 E amfid[112:e91ac] [com.apple.MobileFileIntegrity.framework:default] Restricted entitlements not validated, bailing out. Error: Error Domain=AppleMobileFileIntegrityError Code=-413 "No matching profile found" UserInfo={NSURL=<private>, NSLocalizedDescription=No matching profile found} 2025-06-12 12:37:52.169 Df amfid[112:e91ac] /Applications/foo.app/Contents/MacOS/foo not valid: Error Domain=AppleMobileFileIntegrityError Code=-413 "No matching profile found" UserInfo={NSURL=file:///Applications/foo.app/, NSLocalizedDescription=No matching profile found} The UDID for this VM does look weird, in System Profiler: But I can verify that this UDID string is present in the provisioning profile embedded in the app bundle: $ security cms -D -i /Applications/foo.app/Contents/embedded.provisionprofile | grep -i 7cd9234e9aa4fa8ba528ee417f857b2c993a20a3 <string>7CD9234E9AA4FA8BA528EE417F857B2C993A20A3</string> I also tried deleting the manually added device from the Developer portal and installing Xcode on the VM and letting Xcode register the device, but I end up in the same situation there. Even after letting Xcode itself register the device, it says that "this device not registered to your account" and then when I click "Register device" it changes into " already exists". Has anyone else managed to get Mac development provisioning profiles to work in a VM?

I'm developing a CarPlay version of my app, with the CarPlay EV Charging App entitlement (com.apple.developer.carplay-charging). However, I would like to use the Search template to searching for charging stations — but it seems this template is only available for Navigation Apps(maps). In this case, what is the recommended approach? Is it possible to apply both entitlements simultaneously and use the Search template only?

My app is approved for the Web Browser Public Key Credential Request managed capability and has it added to its App ID Configuration: It has been added to my entitlements file: I am able to build and run unit tests in Xcode locally using my managed profile. When I push changes and Xcode Cloud tries to build and run the app, I get the following error: Mirrai encountered an error (Failed to install or launch the test runner. (Underlying Error: Could not launch “MirraiTests”. Runningboard has returned error 5. Please check the system logs for the underlying cause of the error. (Underlying Error: The operation couldn’t be completed. Launch failed. (Underlying Error: Launchd job spawn failed)))) Removing just the com.apple.developer.web-browser.public-key-credential entitlement, with no other changes, results in all tests passing on Xcode Cloud. Some thoughts: In project settings, the test target has a different bundle id (appending Tests to the app bundle id). Under "Certificates, Identifiers & Profiles," the managed capability is added to the bundle id but it is an explicit bundle id and not a wildcard. Do I need to apply for the managed capability for the test bundle id as well? Or for a wildcard bundle id? xcodebuild-test-without-building.log

Xcode Cloud is unable to run unit tests for a MacOS target after adding a restricted capability (keychain-access-groups). Have tried setting both manual and automatic signing (with a Mac OS development profile). The tests run on my locally fine, but when pushed to Xcode Cloud the crash report indicates a Code Signing Issue, downloading the Artifact for Test Products for AppTests and viewing the app contents I noted that when built locally embedded.provisionprofile appears within the App/Contents that doesn't appear in Xcode Cloud. To reproduce, create a new MacOS app with a test plan, run a Test job (successfully runs) then add the capability for Keychain Sharing: <array> <string>$(AppIdentifierPrefix)com.transmedics.RemoteView.group</string> </array> to the entitlements. Run the job again and tests with the project fails in Xcode Cloud, with code signing issues in the crash report.

Dear Girls, Guys and Engineers. I'm currently building a Home Network Scanner App for People which want to know which Bonjour Devices are in her/his Home Network environment. From an older Question I got the answer, that I need an Entitlement to do this. I started to work on the App and requested the Multicast Entitlement from Apple. They gave me the Entitlement for my App and now I'm trying to discover all devices in my Home Network but I got stuck and need Help. I only test direct on device, like the recommendation. I also verified that my app is build with the multicast entitlement there where no problems. My problem is now, that is still not possible to discover all Bonjour services in my Home Network with the Help of the NWBrowser. Can you please help me to make it work ? I tried to scan for the generic service type: let browser = NWBrowser(for: .bonjour(type: "_services._dns-sd._udp.", domain: nil), using: .init()) but this is still not working even tough I have the entitlement and the app was verified that the entitlement is correctly enabled if I scan for this service type, I got the following error: [browser] nw_browser_fail_on_dns_error_locked [B1] Invalid meta query type specified. nw_browser_start_dns_browser_locked failed: BadParam(-65540) So what's the correct way now to find all devices in the home network ? Thank you and best regards Vinz

Hello everyone, Our team is currently developing a PTT (Push-to-Talk) application using the officially recommended PushToTalk framework. During development, we've encountered a point of confusion regarding the application's behavior after being force-quit by the user. Based on our understanding of the PushToTalk framework documentation (https://developer.apple.com/documentation/pushtotalk/creating-a-push-to-talk-app/) and the PTChannelManager session restoration mechanism, when a user manually kills the app from the background (App Switcher), the current PTT session (the system session managed by PTChannelManager) should terminate. Subsequent pushtotalk type pushes sent via APNS, without an active session, appear to be silently discarded by the system and cannot wake the app for processing (similar to what Kevin Elliott DTS mentioned in https://developer.apple.com/forums/thread/760506 Point D). This seems to prevent reliable PTT message reception in our app after a user force quits. However, we've observed that some popular PTT applications on the market (e.g., TenTen) appear to successfully receive and play PTT voice messages from friends even after the user has performed a force-quit action. This behavior seems inconsistent with our test results and understanding based on the standard framework, posing a challenge for us in providing similar reliability using standard methods. This naturally leads us to wonder how this capability is achieved. We've reviewed developer forums and are aware of the historical existence of a PTT-specific com.apple.developer.pushkit.unrestricted-voip entitlement, which allowed PushKit usage for PTT without CallKit binding. While Apple DTS engineers have repeatedly stated this entitlement is being deprecated and urged migration to the PushToTalk framework (e.g., https://developer.apple.com/forums/thread/763289), we are curious if the observed "wake-after-force-quit" capability might be related to some apps potentially still utilizing this outgoing special entitlement. Alternatively, is there perhaps a mechanism within the standard PushToTalk framework that allows wake-up after force quit that we haven't fully grasped? Therefore, we'd like to ask fellow developers for clarification and discussion: When using the standard PushToTalk framework, have others confirmed that the app indeed cannot be woken up by pushtotalk pushes after being force-quit by the user? Is this the expected behavior? Has anyone successfully achieved a TenTen-like experience (reliable PTT reception after force quit) using only the standard PushToTalk framework? If so, could you share key implementation insights or areas to focus on? (e.g., Is it related to specific usage patterns of the restorationDelegate?) How do you view this potential discrepancy between standard framework capabilities and the behavior exhibited by some apps? What considerations does this bring to development planning and user experience design (especially when users might have expectations set by the "always-on" behavior of other apps)? Are there any best practices or specific techniques when using PTChannelManager session management and restoration that maximize PTT message reliability (especially after the app is terminated by the system in the background), while still adhering to the framework's design principles (like user awareness of the session via UI)? [For instance, another developer raised challenges related to PTT framework restrictions here: https://developer.apple.com/forums/thread/773981] We hope this discussion can help clarify our understanding of the framework and gather community best practices for building reliable PTT functionality while adhering to Apple's guidelines. Thanks for any insights or shared experiences!

How do I gain access to the com.apple.developer.nearby-interaction entitlement for third-party accessory use with Qorvo DWM3001CDK? I've read the documentation but it is not available in Xcode Capabilities. What is the approval process?

Problem Statement We are experiencing a critical and persistent issue preventing the successful signing and building of our iOS application. The core problem is that provisioning profiles, whether automatically generated by Xcode or manually created in the Apple Developer Portal, consistently fail to include the UIBackgroundModes entitlement, leading to a build failure. Specific Question Why are provisioning profiles generated via the Apple Developer Portal and/or Xcode's automatic signing process consistently omitting the UIBackgroundModes entitlement for our App ID, even when this capability is explicitly configured in Xcode? We seek guidance or backend intervention to ensure our provisioning profiles include the necessary entitlement. Expected Outcome We expect to be able to successfully build and sign our iOS application, with provisioning profiles that correctly include the UIBackgroundModes entitlement, allowing for proper implementation of remote notifications. Observed Symptoms Primary Build Error: Consistent build failure with the exact error message: "Automatic signing failed: Provisioning profile 'iOS Team Provisioning Profile: com.scott.ultimatefix' doesn't include the UIBackgroundModes entitlement." Missing Entitlement in Profile (Confirmed by Inspection): Direct inspection of downloaded .mobileprovision files (including those manually generated in the Developer Portal for com.scott.ultimatefix) consistently shows the absence of the UIBackgroundModes entry within the section of the Entitlements dictionary. The aps-environment key for Push Notifications is present, indicating Push Notifications are enabled, but Background Modes are not. Certificates Correctly Recognized in Xcode: Our "Apple Development: Stephen Criscell Scott" and "Apple Distribution: Stephen Criscell Scott" certificates are correctly displayed and recognized in both Keychain Access and Xcode's Preferences &gt; Accounts &gt; Manage Certificates window (without "Not in Keychain" status). Furthermore, the Signing &amp; Capabilities tab for the target in Xcode now correctly shows Signing Certificate: Apple Development: Stephen Criscell Scott. Persistent Issue Across Resets: The problem persists despite extensive local cache invalidation, Xcode reinstallation, and even testing in a fresh macOS user account (which confirmed the issue was not user-specific).

I have an app that needs to seize USB devices, in particular it needs the USBInterfaceOpenSeize call to succeed. I've got a provisioning profile with this entitlement, I've added this plus this entitlement to my app but the USBInterfaceOpenSeize still fails. Am I correct in thinking this is the correct/only entitlement I need for this? If so how do I check if I'm using the profile/entitlements correctly? The call succeeds if I run the application as root which makes me think it's a permissions issue. Thanks.

I’m encountering an issue when trying to start a macOS VM using Apple’s Virtualization framework in a sandboxed environment. When I create a standalone Xcode project, the VM launches successfully. However, when I integrate the same code into my existing project—where the VM is launched by a service started via launchd and running in a sandbox—it fails with the following error: Internal Virtualization Error: Failed to issue USB HCI sandbox extension To resolve this, I tried adding the com.apple.security.device.usb entitlement. But after doing that, the app started crashing with the following trace : Application Specific Signatures: SYSCALL_SET_USERLAND_PROFILE Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsystem_secinit.dylib 0x19a7141bc _libsecinit_appsandbox.cold.9 + 84 1 libsystem_secinit.dylib 0x19a713324 _libsecinit_appsandbox + 2080 2 libsystem_trace.dylib 0x18c2326cc _os_activity_initiate_impl + 64 3 libsystem_secinit.dylib 0x19a712ab0 _libsecinit_initializer + 80 4 libSystem.B.dylib 0x19a72a32c libSystem_initializer + 280 5 dyld 0x18c162efc invocation function for block in dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const + 444 6 dyld 0x18c19f864 invocation function for block in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const + 324 7 dyld 0x18c1bf58c invocation function for block in mach_o::Header::forEachSection(void (mach_o::Header::SectionInfo const&, bool&) block_pointer) const + 240 8 dyld 0x18c1bc318 mach_o::Header::forEachLoadCommand(void (load_command const*, bool&) block_pointer) const + 208 9 dyld 0x18c1bda58 mach_o::Header::forEachSection(void (mach_o::Header::SectionInfo const&, bool&) block_pointer) const + 124 10 dyld 0x18c19f334 dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const + 516 11 dyld 0x18c162cb4 dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const + 176 12 dyld 0x18c16e530 dyld4::PrebuiltLoader::runInitializers(dyld4::RuntimeState&) const + 44 13 dyld 0x18c1848b0 dyld4::APIs::runAllInitializersForMain() + 88 14 dyld 0x18c147e00 dyld4::prepare(dyld4::APIs&, mach_o::Header const*) + 3092 15 dyld 0x18c1471d8 dyld4::start(dyld4::KernelArgs*, void*, void*)::$_0::operator()() const + 236 16 dyld 0x18c146b4c start + 6000 I suspect this might be due to the provisioning profile, which doesn’t seem to include the required entitlement. However, I haven’t found a way to explicitly add this entitlement to the provisioning profile. My questions are: How can I add com.apple.security.device.usb to the provisioning profile? Is there a way to confirm that adding this entitlement would resolve the issue? Are there recommended steps to debug and test Virtualization framework usage in a sandboxed environment (especially when launched as a service)? I also tried disabling SIP and AMFI, but the crash still occurs. Is there a better way to work around or test this in development? Any insights or suggestions would be greatly appreciated!

Hi all, I’m running into an issue with provisioning profiles not including the com.apple.developer.push-notifications entitlement — even though everything seems to be configured correctly. Here's what I’ve done: Checked the App ID has Push Notifications enabled. I’ve clicked “Configure” and created a Production APNs certificate under the App ID. I’ve regenerated the provisioning profiles (Ad Hoc and App Store). I can see within the profiles within App Store Connect that the push notifications capability is listed I’ve downloaded and decoded the profiles using: security cms -D -i profile.mobileprovision &gt; decoded.plist But com.apple.developer.push-notifications is still missing under the &lt;key&gt;Entitlements&lt;/key&gt; block. This is causing issues because: When I submit the build to eas I receive this error from XCode: - Provisioning profile "*** Adhoc" doesn't include the com.apple.developer.push-notifications entitlement. Profile qualification is using entitlement definitions that may be out of date. Connect to network to update. (in target '***' from project '***') Refer to "Xcode Logs" below for additional, more detailed logs. To isolate the issue further I: Created a completely new App ID, enabling Push Notifications from the start. Created new APNs certificate. Generated new provisioning profiles with a valid distribution certificate. Still no push entitlement embedded in the profile. Question: Has anyone else encountered this issue where Push Notifications are enabled and configured, but the entitlement still fails to embed in the profile? Thanks in advance.

Hello all, Does anyone know how long it will take Apple to approve multicast entitlement approval after the Apple form is submitted? Any input would be appreciated. Thank you Allyson

Hi, I had a few questions regarding the multicast networking entitlement. What are the criteria for approval? Do ad-hoc multicast protocols fall under the approval criteria? How long do approvals for multicasting generally take?

Hello! I do know apple does not support electron, but I do not think this is an electron related issue, rather something I am doing wrong. I'd be curious to find out why the keychain login is happenning after my app has been signed with the bundleid, entitlements, and provision profile. Before using the provision profile I did not have this issue, but it is needed for assessments feature. I'm trying to ship an Electron / macOS desktop app that must run inside Automatic Assessment Configuration. The build signs and notarizes successfully, and assessment mode itself starts on Apple-arm64 machines, but every single launch shows the system dialog that asks to allow access to the "login" keychain. The dialog appears on totally fresh user accounts, so it's not tied to anything I store there. It has happened ever since I have added the provision profile to the electron builder to finally test assessment out. entitlements.inherit.plist keys &lt;key&gt;com.apple.security.cs.allow-jit&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.cs.allow-unsigned-executable-memory&lt;/key&gt; &lt;true/&gt; entitlements.plist keys: &lt;key&gt;com.apple.security.cs.allow-jit&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.security.cs.allow-unsigned-executable-memory&lt;/key&gt; &lt;true/&gt; &lt;key&gt;com.apple.developer.automatic-assessment-configuration&lt;/key&gt; &lt;true/&gt; I'm honestly not sure whether the keychain is expected, but I have tried a lot of entitlement combinations to get rid of It. Electron builder is doing the signing, and we manually use the notary tool to notarize but probably irrelevant. mac: { notarize: false, target: 'dir', entitlements: 'buildResources/entitlements.mac.plist', provisioningProfile: 'buildResources/xyu.provisionprofile', entitlementsInherit: 'buildResources/entitlements.mac.inherit.plist', Any lead is welcome!

There is an inconsistent issue when views are rendered from the Device Activity Report Extension. This issue is noticeable only on release versions and it works fine in debug mode. Around 80% of the times, the Report Views return blank screen and this is only the case when a weekly/monthly filter is used. Although, it works as expected for daily report views. My questions are: How are all the Report Activity Views working fine in debug mode but not in release mode? How the daily activity filter works fine in the release mode but the weekly/monthly filters don't work? Is this because of a memory limit issue in the extension? As of now, I have the family-controls(distribution) entitlement only for the app and for the extensions I only have family-controls(development) entitlement. Do I need to request for family-controls(Distribution) entitlement even for the extensions? I have seen threads on the forum mentioning the blank screen issue associated with the DeviceActivityReport but haven't found a solution to it. Any suggestions/feedback would be of great help, thanks.

Subject: Assistance Needed with Enabling Speech Recognition Entitlement for iOS App Hi everyone, I’m seeking guidance regarding the Speech Recognition entitlement for my iOS app using Capacitor. Our App and we submitted a request to Apple Developer Support four days ago, but have not yet received a response. 🧩 Summary of the issue: Our app uses the Capacitor speech recognition plugin (@capacitor-community/speech-recognition) to listen for native voice input on iOS. We have added both of the required keys in Info.plist: NSSpeechRecognitionUsageDescription NSMicrophoneUsageDescription We previously had a duplicate microphone key, which caused the system to silently skip the permission request. After removing the duplicate, we did briefly see the microphone permission prompt appear. However, in our most recent builds, the app launches without any prompts, even on a fresh install. The plugin reports: available = true permissionStatus = granted Despite this, no speech input is ever received, and the listener returns nothing. We believe the app is functioning correctly at a code level (plugin loads, no errors, correct Info.plist), but suspect the missing Speech Recognition entitlement is blocking actual access to the speech system. 🔎 What we need help with: How can we confirm whether the Speech Recognition entitlement is enabled for our App ID? If it’s not enabled, is there a way to escalate or re-submit the request? Our app is currently stuck until this entitlement is granted. Thank you for your time and any guidance you can offer!

I am building an iOS app with the App ID: com.echo.eyes.app I have a paid Apple Developer membership and have followed all correct procedures, including: Adding com.apple.developer.speech-recognition manually to the App.entitlements file Setting Info.plist keys for microphone and speech permissions Assigning my Apple Developer Team to the project Setting App/App.entitlements under Code Signing Entitlements Despite all this, Xcode automatic signing fails, and I receive the error: vbnet Copy Edit Provisioning profile 'iOS Team Provisioning Profile: com.echo.eyes.app' doesn't include the com.apple.developer.speech-recognition entitlement. I am unable to add the entitlement via the Capabilities section, and no method I try will allow provisioning to succeed. Please update this App ID to include the required entitlement in the provisioning profile. This issue is preventing all voice recognition functionality. Thank you.

How to add speech recognition in + capability in Xcode there is no "Speech Recognition" in the list.