@DTS Engineer Returning back to this issue. Tried macOS style and iOS style App Groups and other combinations. Even though the app group was authorized via provisioning profile, the problem still occurs for direct distribution. The interesting part is when I change a developer team and use the same format of AppGroups, Keychain groups and bundle id, the directly distributed app starts as the gatekeeper does not kill the launch job. FYI, we are using an App Extension. Also changing bundle-id while using the same developer team did not help, nor did generating new provisioning profiles over and over.