I’m building an iOS app that uses a Network Extension Content Filter provider. The app works when installed directly on a physical device from Xcode/development builds, but the same flow fails in TestFlight/App Store distribution builds. Main app bundle ID: com.project.betcontrolMain Network extension bundle ID: com.project.betcontrolMain.DNSFilterExtension Team ID: 74YN2U5NR9 The extension is embedded at: Runner.app/PlugIns/DNSFilterExtension.appex Both the containing app and extension are signed with: com.apple.developer.networking.networkextension = content-filter-provider The app also has Family Controls Distribution enabled. At runtime, enabling the content filter with NEFilterManager fails in TestFlight with: NEFilterErrorDomain code 5 - permission denied The same code path works when installed locally from Xcode. The code roughly does: NEFilterManager.shared().loadFromPreferences { error in let manager = NEFilterManager.shared() let providerConfiguration = NEFilterProviderConfiguration() providerConfiguration.filterBrowsers = true providerConfiguration.filterSockets = true providerConfiguration.vendorConfiguration = [:] manager.localizedDescription = "BetControl Website Shield" manager.providerConfiguration