For the record I've now got this working with the entitlement and profile with the addition of using IOServiceAuthorize.

We are a Remote Desktop virtualisation app. We do have com.apple.vm.device-access in our provisioning profile. We are not distributed via the App Store.