Do I need to request Packet Tunnel Provider entitlement from Apple to get my app working?

I'm debugging an app I'm building and everything I'm seeing suggests I need to put in a request to Apple to turn on NetworkExtension → Packet Tunnel Provider entitlement for our Team ID and bundle IDs.

1: Is this true?

2: Doesn't the option in xcode handle this?

A bit more context:

2026-02-18 11:47:51.763041-0600 0x97177    Info        0x0                  209    0    nehelper: [com.apple.networkextension:] Created a new configuration delegate with name = PIA Split Tunnel, bundleID = com.privateinternetaccess.vpn.splittunnel.cli, applicationID = com.privateinternetaccess.vpn.splittunnel.cli, entitled = 1, hasProviderPermission = 1

2026-02-18 11:48:16.576069-0600 0x97177    Info        0x0                  209    0    nehelper: [com.apple.networkextension:] Created a new configuration delegate with name = ***, bundleID = ***, applicationID = ***, entitled = 0, hasProviderPermission = 0

2026-02-18 11:48:16.576142-0600 0x9772a    Error       0x0                  209    0    nehelper: [com.apple.networkextension:] *** Failed to obtain authorization right for 3: no authorization provided

See that entitled = 0, hasProviderPermission = 0?

Do I need to request Packet Tunnel Provider entitlement from Apple to get my app working?
 
 
Q