Hello everyone, I'm facing a critical build issue related to Family Controls entitlements and would appreciate any insights or help from the community or Apple engineers. My Goal:
I am trying to build and run my app on a physical device to test my DeviceActivityMonitor and ShieldConfigurationExtension. I have already been approved for the Family Controls (Development) entitlement.
The Problem: When I try to build, Xcode fails with the following errors, preventing me from testing:
- For my DeviceActivityMonitor target:
Provisioning profile "..." doesn't include the com.apple.developer.deviceactivity entitlement.
- For my SOSAppShieldExtension target:
Provisioning profile "..." doesn't include the com.apple.developer.screen-time-api entitlement.
The Core Evidence:
This seems to be a server-side issue with how the provisioning profiles are generated. I have used the security cms -D -i command to inspect the downloaded .mobileprovision files. The inspection reveals that the profiles do contain the parent com.apple.developer.family-controls entitlement. However, they are missing the required child entitlements:
- The profile for my monitor extension is missing <key>com.apple.developer.deviceactivity</key>.
- The profile for my shield extension is missing <key>com.apple.developer.screen-time-api</key>.
Troubleshooting Steps I've Already Taken: I believe I have exhausted all possible client-side fixes. Here is what I have tried over the past few days:
- Confirmed Approval: I am fully approved for the Family Controls (Development) entitlement.
- Enabled Capabilities: The "Family Controls" capability is checked and enabled for all three relevant App IDs (main app, monitor extension, shield extension) on the developer portal.
- Profile Regeneration: I have deleted and regenerated all provisioning profiles for all targets multiple times.
- Forcing a Server Refresh: I have toggled the "Family Controls" capability off, saved, and then toggled it back on and saved again for each App ID.
- Creating New Identifiers: I created a brand new, clean App ID for the DeviceActivityMonitor extension (com.sosapp.ios.devicemonitor) and created a new profile for it, but the error persists.
- Xcode Configuration: I am using manual signing in Xcode and have double-checked that each target is pointing to the correct, newly downloaded provisioning profile. I have also cleaned the build folder and deleted Derived Data multiple times.
My Question:
Given that my account is approved and the capability is enabled, but the generated profiles are provably missing the necessary child entitlements, this points directly to a bug in the profile generation service on Apple's backend.
Has anyone else experienced this specific issue where the parent entitlement is present but the required child entitlements are missing? Is there a known workaround, or can an Apple engineer please investigate the profile generation for my Team ID? Any help would be greatly appreciated. Thank you!