Can someone tell me the applications requirements for using the secure enclave on MacOS? Does the application need to be signed with the secure-enclave entitlement in order to use it? Since this is a restricted entitlement, does my App ID need approval to use it from Apple? Currently I'm building in XCode 16 on Sequoia (15.5) using developer signing. My application is a C/C++ daemon running as plist out of /Library/LaunchDaemons. I have also built it as an application using the instructions here but this has not lead to a solution: https://developer.apple.com/documentation/xcode/signing-a-daemon-with-a-restricted-entitlement/ When I run my application from the command line via sudo signed but without the secure-enclave entitlement enabled in my entitlements file it runs. The first call to: SecAccessControlRef access = SecAccessControlCreateWithFlags( kCFAllocatorDefault, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, kSecAccessControlPrivateKeyUsage, &error); succeeds without error. The call to create the key using: SecKeyRef privateKey = SecKeyCreateRandomKey(attributes, &error); then fails with error: (OSStatus error -50 - Failed to generate keypair) Here are the setup attributes (keySize = 256): CFDictionarySetValue(attributes, kSecAttrKeyType, kSecAttrKeyTypeECSECPrimeRandom); CFDictionarySetValue(attributes, kSecAttrKeySizeInBits, keySize); CFDictionarySetValue(attributes, kSecAttrLabel, keyName); CFDictionarySetValue(attributes, kSecAttrApplicationTag, keyLabel); CFDictionarySetValue(attributes, kSecAttrTokenID, kSecAttrTokenIDSecureEnclave); // Store in the Secure Enclave CFDictionarySetValue(attributes, kSecAttrKeyClass, kSecAttrKeyClassPrivate); CFDictionarySetValue(attributes, kSecAttrAccessControl, access); CFDictionarySetValue(attributes, kSecAttrIsPermanent, kCFBooleanTrue); // persist key across app restarts and reboots CFDictionarySetValue(attributes, kSecAttrCanEncrypt, kCFBooleanTrue); CFDictionarySetValue(attributes, kSecAttrCanDecrypt, kCFBooleanTrue); CFDictionarySetValue(attributes, kSecAttrAccessible, kSecAttrAccessibleWhenUnlockedThisDeviceOnly); CFDictionarySetValue(attributes, kSecReturnPersistentRef, kCFBooleanTrue); When I run the application signed and include the "com.apple.developer.secure-enclave" in my entitlements file it crashes at startup. I believe this is to be expected based on above. How do I proceed such that my application can use the secure enclave correctly?

I'm posting this here after reading Quinn's post here: https://developer.apple.com/forums/thread/799000 The above entitlement is mentioned in IOUSBHostControllerInterface.h. It isn't an entitlement one can add using the + button on the Capabilities panel in Xcode. If I try to add it by hand, Xcode complains that it isn't in my profile. Is this a managed entitlement? We'd like to create a local USB "device" to represent a real device reachable over a network.

An existing development-signed arm64 iPad Release build succeeds in Xcode, including its code-signing step. Post-build static verification from a restricted automation environment reports CSSMERR_TP_NOT_TRUSTED for Runner, App.framework, and Flutter.framework. The recorded commands were: codesign --verify --deep --strict --verbose=6 <app-path> codesign --display --entitlements - --xml <app-path> The entitlements command returns no XML and reports: binary contains an invalid entitlements blob; OS will ignore these entitlements This warning occurs only for Runner. The two frameworks have no entitlements slots. A public Security framework code-signing trust evaluation returned false, TrustResultValue 0, and an empty detailed result. The error and last underlying error were NSOSStatusErrorDomain / -26276, with description "OSStatus -26276". Existing observations: The Apple Development signing certificate matches the provisioning profile, which includes the target iPad. Keychain Access showed valid certificates using system-default trust. Offline code-page/resource hash and CMS signature checks matched. Offline parsing found matching XML/DER entitlement values within the profile's allowed values. These checks do not establish native trust or installation validity. The host is an Apple Silicon Mac and the target is a physical iPad. We have not isolated a focused Xcode sample that reproduces this issue. The original app contains Flutter and other integrations. We do not know whether the cause is in the artifact, trust evaluation, or the restricted execution environment. An OS log query was denied by that environment; it has not been retried or bypassed. We have not changed certificate trust, re-signed, rebuilt, or attempted installation to work around the verification failure. What supported, narrowly scoped diagnostic procedure would: distinguish a genuine trust-policy rejection from an evaluation that could not complete, diagnose the Runner-only entitlements warning, and establish whether the unchanged artifact is installable? Please advise the minimum redacted evidence or focused sample needed. We are seeking Apple's supported diagnostic route without exporting credentials or weakening trust settings. Attachments: none.

Hello everyone, I'm currently developing a macOS application called macOSDocker, which uses Apple's Virtualization.framework to run a lightweight Linux virtual machine hosting Docker containers. One of the main features is bridged networking using VZBridgedNetworkDeviceAttachment, allowing the virtual machine to obtain its own IP address on the local network and making Docker containers directly accessible without additional NAT or port forwarding. However, this requires the restricted com.apple.vm.networking entitlement. Application details: App: macOSDocker Bundle ID: com.macOSDocker Team ID: RYPSKH8HG5 Apple Developer Support Case: 102997773774 I've already contacted Apple Developer Support to request access to this entitlement, but they directed me to the Apple Developer Forums instead. Currently, Xcode reports that the com.apple.vm.networking entitlement is missing from my provisioning profile. My questions are: What is the official process for requesting approval for the restricted com.apple.vm.networking entitlement? Is there a specific form or contact within Apple Developer Relations for submitting such a request? I would appreciate any guidance, particularly from Apple engineers, on how to proceed with the entitlement approval process. Thank you! Kevin

We have developed a driver for our WiFi HaLow chipset, but are unable to progress beyond development because our entitlement request has stalled. We have received development entitlements, but these "require provisioning support" The original request was: Entitlement name: DriverKit, DriverKit USB Transport, and DriverKit Networking Business need: Distributing drivers for Morse Micro Wi-Fi HaLow Network Adapters Request date: 7 August 2026 Request ID: C7HYK62R73 When I followed up by email, I was asked to have the Account Holder (rather than a mere admin) reiterate the request to devprograms@apple.com, which I did. That was Follow-up number: 102965131843 The request from the Account Holder was on 21 September. When I followed up on 14 October, I was told to have the Account Holder follow up. None of the responses have asked for any additional information, nor have they offered any insight as to what may be blocking the request beyond the fact that I'm not the Account Holder. No responses have been sent to the Account Holder at all. What's blocking this? We're seeing increasing pressure from major accounts to support macOS, and are powerless to do so.

Could someone help expedite our pending DriverKit USB distribution review request? Our driver works under development signing, but approval is blocking a TestFlight pilot for our accessibility product. Request: 8AR5R3NKZD Submitted October 18, 2026 (still "Submitted") Team: 7U9T57JPF7 Capability: DriverKit USB Transport – VendorID USB: VID 6790 (0x1A86), PID 29987 (0x7523) Support case: 103013236358 Thank you!

I have requested two entitlements for my driver: "DriverKit USB Transport - VendorID" and "DriverKit UserClient Access" I have submitted them in Sep 20, and got no response or ETA on it. It's the only thing blocking the release of my driver. Request ID: C9ULM24X2U Team: F34U2UUGXX Status: Submitted What can I do to expedite this?

Hello! I am hoping a DTS engineer or someone who knows the Capability Requests portal can help, because I am stuck between a written support confirmation and what the portal actually shows. Background. We are building a native macOS iSCSI initiator for SOHO and home NAS use, developed over close to two years. A userspace daemon runs the iSCSI protocol and a DriverKit system extension presents the remote LUN as a block device. The code is essentially complete. Only the DriverKit extension cannot be signed, loaded and validated without the entitlement. We submitted request 32PC8MGU57 for two entitlements: com.apple.developer.driverkit.family.block-storage-device for the extension com.aviontex.iscsi.AviontexISCSI.AviontexInitiator com.apple.developer.driverkit.userclient-access for the app com.aviontex.iscsi.AviontexISCSI, scoped to the extension bundle id The problem. On June 25 Developer Support confirmed in writing that both entitlements were granted. The portal does not match that: Block Storage Device: No Requests: on both App IDs UserClient Access: Assigned: on the app SCSI Controller: Submitted: on the app So the one entitlement we actually need, Block Storage Device, shows as never requested, even though request 32PC8MGU57 covered it and support confirmed the grant. The case was escalated to the senior team on July 2 (case 102922935570). Follow-up emails since then have not received a response. Why Block Storage Device specifically Our initiator has no PCI or Thunderbolt bus and no DMA path, so SCSIControllerDriverKit does not fit. This is confirmed by DTS in thread 776020, where Kevin Elliott explains that SCSIControllerDriverKit passes data through fBufferIOVMAddr as a physical address with no mechanism to convert it into a VM address the dext can access. He also notes it cannot be used with any bus other than PCI or Thunderbolt. Block Storage Device is therefore the family we need. My questions: Am I reading the portal correctly: Block Storage Device not requested, UserClient Access assigned, SCSI Controller submitted? From here, what is the correct way to get Block Storage Device onto these two App IDs, with both the Development and the Distribution grant, since our public beta depends on Distribution? Should I submit a new request through the Capability Requests tab or does the escalated case handle it? Is there any way to get visibility on the escalated case, since email follow-ups are not being answered? A full technical justification is prepared and we are happy to share the source code. Any guidance would be appreciated. Thank you.

Hi, My NEURL Filter configuration (ID 9f3cbff8-63de-4c69-bf68-c19cd1c5d842) was approved on August 5, 2026, but it turned out to be attached to the wrong Apple Developer Team — an old individual account (S5VDH23BBZ) I no longer have access to, instead of my actual organization team, KRKJ76BC7W (SCOTTO), which owns and signs the app (bundle ID com.dropbet.DropBet). I contacted Developer Support, who said they couldn't transfer it and suggested replying to the original approval email — I did (on 08/08, then several times) with no response. I then tried resubmitting the same configuration under the correct team (KRKJ76BC7W), but the portal rejected it with: "A configuration with the same PIR Server Domain already exists." So a fresh submission is technically impossible while the original stays attached to the wrong account — the only real fix is transferring or re-attaching the existing approved configuration to KRKJ76BC7W. Has anyone dealt with this kind of Team ID mix-up before, or know who on the Network Extension / NEURL Filter team could help reassign an approved configuration? Happy to provide any additional details. Thanks in advance.

It has been 20 days since we applied for Family Controls (Distribution) permission, but the status still shows as Submitted. Is there any way to expedite the review process?

I’m developing an ARM64-native Wine + FEX compatibility runtime on Apple Silicon, without relying on Rosetta 2. According to the August 2026 Wine-devel discussion, the following entitlement is intended to be available to free developer accounts: com.apple.developer.cross-architecture-support-unmanaged However, I have encountered the following issues: My Xcode Personal Team does not offer a “Cross-architecture Compatibility Framework” capability. Certificates, Identifiers & Profiles is inaccessible to my free developer account. I cannot obtain a provisioning profile authorizing this entitlement. I contacted Apple Developer Support. They explained that entitlement requests generally require an Apple Developer Program Account Holder, but were unable to confirm whether this particular entitlement is currently requestable or where to request it. Could an Apple engineer clarify: Is the unmanaged entitlement currently available to free Personal Teams? What is the official App ID, provisioning profile, and code-signing procedure? Does this entitlement require additional approval from Apple? If it is unavailable, is there an officially supported alternative for development of an ARM64-native Wine loader? My goal is to use the native macOS cross-architecture features while keeping SIP and other security protections enabled. Relevant Wine-devel discussion: https://list\.winehq\.org/hyperkitty/list/wine\-devel%40list\.winehq\.org/thread/CKG5CEN2BE5VRXZ7O7NX4YUSBH3247WH/ Thank you.

Is the com.apple.developer.kernel.increased-memory-limit entitlement working as of iOS 15 Beta 3. As of right now if I try to add this entitlement on Beta 3 or below, the Automatic Signing fails. How much extra memory would be provided for an Application or its extension with this entitlement?

Hello, I have requested entitlements for my DriverKit-based driver, but the status has been "Submitted" since May 24, 2026. Below are the details of my request. Is there any way to expedite the process, as these entitlements are necessary for distributing the app? Also, what is the preferable way to follow up in such cases? Entitlements: DriverKit USB Transport - VendorID (0x0BDA), DriverKit UserClient Access Team: K89F9CL4ZU Request Id: 7W5RQ3D2X6 Requested At: May 24, 2026 Type: Team Status: Submitted Many thanks

Hi everyone, I'm building rewindDV, a macOS app for preserving recordings from older FireWire tape cameras and decks. Capture works on our development hardware, and I'm trying to get the PCI transport entitlement needed to move forward with Developer ID signing and notarization so testers can use it with SIP enabled. Our two original requests have been pending since August 1. Developer Support confirmed that DriverKit and UserClient Access are present, but PCI transport approval is still missing. They suggested resubmitting, so I sent a consolidated request today and added the new number to the existing support case. Here are the references: Original requests: 265MP3ZN42 and 49L9RB632H — August 1, 2026; both still showed Submitted today. New request: 5728BY853G — October 3, 2026. Developer Support case: 102964703572. We're requesting DriverKit PCI (PrimaryMatch) for Developer ID distribution, specifically com.apple.developer.driverkit.transport.pci with IOPCIPrimaryMatch = 0x590111C1. That's PCI vendor 0x11C1 (4545 decimal), device 0x5901 (22785 decimal): the Agere/LSI FireWire OHCI host controller, not the downstream camera or deck. We develop the software, not the controller, and are requesting only that exact pair. PCI development access is already assigned. Could someone familiar with the DriverKit review process check whether the new request is in the right queue and whether we're missing anything? I'd also appreciate guidance on which request to keep active, since I haven't cancelled either original. I understand there's no guaranteed turnaround time. After nine weeks, I'd just like to make sure nothing is waiting on us. Happy to provide more technical details if helpful. Thanks for your help!

Hi, Canary Mail has had approval to use the Default Mail App entitlement for years. We have a longstanding Xcode Cloud export failure involving com.apple.developer.mail-client. In our latest iOS build, compilation and archiving succeed (ARCHIVE SUCCEEDED). All three subsequent exports—App Store, Ad Hoc, and Development—fail with the same error: error: exportArchive Entitlement com.apple.developer.mail-client not found and could not be included in profile. This likely is not a valid entitlement and should be removed from your entitlements file. We checked the signing configuration and Developer portal: • The main app requests com.apple.developer.mail-client = true. • An existing manual App Store provisioning profile is active until June 2027. Decoding the downloaded profile confirms it contains com.apple.developer.mail-client = true and matches the app's bundle identifier and team. • Local development archiving also succeeds with our existing manual Default Mail App development profile. • However, Default Mail App is absent from both the Capabilities and Capability Requests tabs for this App ID. This appears related to these reports, where Apple corrected the entitlement's distribution grants: https://developer.apple.com/forums/thread/774506 https://developer.apple.com/forums/thread/800072 Our case differs because all three export modes fail, rather than only Ad Hoc. Apple's provisioning documentation describes migrating older additional entitlements into App ID managed capabilities for cloud-managed signing: https://developer.apple.com/help/account/reference/provisioning-with-managed-capabilities Could our older Default Mail App approval still be available through manual provisioning profiles but not migrated to the managed capability used by Xcode Cloud? What is the correct support route to have Apple verify/migrate this approval and ensure Development, Ad Hoc, and App Store export are supported? If the grant is already correct internally, could this be a Cloud provisioning service issue? Is there a supported way to use our approved manual App Store profile for Xcode Cloud's built-in export while this is investigated? We need to preserve default-mail functionality, so removing the entitlement is not a suitable production workaround. We can provide the full distribution logs and profile details privately to Apple Support. Thank you.

Hi, I am working on a personal HIDDriverKit project. The documentation suggests that you do not need the entitlements from Apple to do local development - that all you need to do is turn of SIP, enable developer mode, and turn signing to "Sign to Run Locally". However, I have followed all of these steps, and am still running into the error that to build, I need to have a provisioning profile with the DriverKit (development) feature (MacOS 15.2 Xcode 16.2). Am I missing something here regarding the steps for local development? Does one need to request a development version of the entitlements even for local development? Do I need a paid developer account to do this? Thank-you in advance.

Our app Newton Mail (App ID com.CloudMagic.Mail, App Store app 721677994, Team 53X8EK4BSQ) held the com.apple.developer.mail-client entitlement for years. Newton shipped as a default-mail-capable app starting with iOS 14, and our January 2024 App Store distribution profile (release_appstore_com.CloudMagic.Mail) still contains the entitlement. The grant is no longer active. Automatic signing now fails with: Entitlement com.apple.developer.mail-client not found and could not be included in profile. This likely is not a valid entitlement and should be removed from your entitlements file. The Default Mail App capability does not appear on our App ID in Certificates, Identifiers & Profiles, nor in the Capability Requests tab. This looks like the same migration issue described in these threads: https://developer.apple.com/forums/thread/821303 (same error on a years-old grant, fixed server-side by Apple) https://developer.apple.com/forums/thread/806537 (grant only "partially migrated" to the managed capability) What we have tried since July 2026: July 9: emailed the entitlement team. No response. August 31 and September 5: submitted the Default Mail Client request form. No confirmation page or reference number either time. September 13: resubmitted the form and received Request ID L8JM288VBQ. Support case 102959495479: support confirmed we are not currently granted the entitlement. Our follow-ups on September 18 and September 23 got no reply. Phone case 102973381060: the callback was marked "no answer" 44 seconds after we requested it, and the phone never rang. The current App Store version (10.0.94) meets all four published requirements: mailto: is declared in Info.plist, the app sends to any recipient, the mailto handler opens a compose view with To: pre-filled, and the app receives from any sender. Could someone from DTS take a look, or tell us the right channel to get the migrated grant restored? Thank you.

Hi team, Earlier, Apple’s documentation clearly mentioned that we needed to submit a request to Apple to obtain the Location Push Service Extension (com.apple.developer.location.push) entitlement. However, when I checked the Apple Developer Portal now, I don’t see an option to request this entitlement for my App ID. Could you please confirm whether this entitlement is still required to be requested from Apple, or if the process has changed and the request is no longer required? Thanks

When attempting to build an Apple Vision Pro application written in Swift in Xcode, we get the following status errors: "Provisioning profile [Profile Name] doesn't include the Main Camera Access capability.” and "Provisioning profile [Profile Name] doesn't include the com.apple.developer.arkit.main-camera-access.allow entitlement.” The provisioning profile we are attempting to use DOES have the Main Camera Access capability enabled through the Apple Developer portal. We have tried deleting and remaking the profile multiple times, as well as creating new profiles with the same settings, but completely different names and bundle identifiers, but keep getting the same errors. We DO have the "com.apple.developer.arkit.main-camera-access.allow” added to the entitlements file of the Xcode project, and we DO have the “NSMainCameraUsageDescription” key added to the info.plist file, along with the needed string describing the camera usage. Our organization has a valid and active Enterprise account, through which we have requested and been granted access to the “Main Camera Access” capability. We have built this applications multiple times before in the past year with no issues, these errors began after one of our provisioning profiles expired and we re-made it. We have tried clearing the Provisioning Profile Cache on our machine, clearing the Derived Data in the Xcode settings, and clearing the Xcode build cache. We are experiencing these errors on multiple machines, with different versions of our app, and with completely different apps that use the Main Camera Access entitlement. We experience these errors when the profile is downloaded directly in Xcode, and when it is downloaded from a browser and imported into Xcode. When we use “Automatically manage signing” our app properly builds and deploys to the Vision Pro, but when we use the app and attempt to access the main camera, the app crashes with the exception: "Exception: This app failed to request an authorization.” We have searched online forums and found several instances of others that have experienced this problem, but have not found a solution that works. Software Versions: Xcode Version: 26.6 macOS Version: Tahoe 26.5.1 VisionOS Version: 26.5

I have requested an entitlement for my DriverKit based driver, but the status is still in "Submitted" phase. I have also tried contacting Apple Support by phone/mail but to no avail [Case ID: 20000143721904]. Below are the details of my request. Is there any way to know the turnaround time or to expedite the process as this entitlement is necessary for the distribution of our app? Also, what is the preferrable way to follow up in such cases? Entitlement: com.apple.developer.driverkit.transport.pci - DriverKit PCI (PrimaryMatch) Team: 8S33FS7Q5Q Request Id - NZYWRD96U3 Requested At - August 13, 2026 Type - Team Status - Submitted Thank you, Abishek.