Hello, I have a follow up question. It is by design the sandbox gets inherited when running a command line tool using the Process.run() from an application signed by a different Team ID? Eg. the PowerPoint app authored by the Team ID UBF8T346G9 runs a tool signed by Team ID 44X73QA89R (a different developer team) and the tools inherit's the PowerPoint app's sandbox.

[quote='804374022, Frameworks Engineer, /thread/763878?answerId=804374022#804374022'] macOS Sequoia now requires that a hotkey registration use at least one modifier that is not shift or option. [/quote] How does this even prevents key loggers?

We understand that entitlements require the app to be sandboxed and preferably we would have it sandboxed and available on Mac App Store. Based on our testing the sandboxed app with a temporary exception was able to read/write data to Group Containers on macOS 14. Thanks for the link to the File System Permissions article. I don't think the Microsoft will change PowerPoint / Office apps architecture to use ExtensionKit. Yet, they have a supported and documented way of installing the extensions if customer is using Finder. In such case the user is not prevented from making changes to the User Content.localized/Add-Ins.localized/ - therefore our customer expect an app would be able to the same for them. So if I understand it correctly, the only way to install and register the extensions would be by a tool created by Microsoft which can therefore write data to UBF8T346G9.Office container. But how such tool would get the extension files from our app's container if apps cannot read data between different TeamID containers?