Update: After inspecting all provisioning profiles on our system, we found that: Profiles generated for development and Developer ID distribution contain content-filter-provider Profiles generated via Direct Distribution contain only packet-tunnel-provider-systemextension and app-proxy-provider-systemextension No profile contains content-filter-provider-systemextension When we set content-filter-provider-systemextension in the entitlements file (matching Little Snitch's configuration), Xcode rejects all available profiles with a mismatch error. This means the Developer Portal does not appear to generate provisioning profiles with content-filter-provider-systemextension for content filter system extensions. Is this a portal issue, or is there a different provisioning mechanism required?