com.apple.developer.automatic-assessment-configuration entitlement missing from manually downloaded Distribution/InHouse Provisioning Profile

So, the behaviour you’re seeing is expected. This capability is restricted to specific distribution models. To confirm that, follow the instructions in Finding a Capability’s Distribution Restrictions.

As to what you should do about that, it kinda depends on how your product is deployed. You wrote:

We are implementing an exam mode feature for an educational app used in schools

In-House (Enterprise) distribution is intended to be used for apps deployed within your enterprise. Presumably these schools are separate organisations, which means you must use some other distribution mechanism to distribute your app to them. What is that mechanism? The App Store?

If so, the standard path forward here is to use your Organization team for both development and distribution. I see a lot of folks use In-House (Enterprise) for internal testing, and that’s not something I recommend [1]. Rather:

• Use Apple Development code signing for day-to-day debugging.
• Use Apple Distribution code signing for App Store builds.
• Use TestFlight for internal testing.
• And for public beta testing.
• If necessary, use Ad Hoc distribution for internal testing. But, honestly, TestFlight is better (-:

And you do all of this from your Organization team.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] In addition to problems like this, you have to use a different App ID because each App ID is assigned to one specific team. That complicates your build process, and it also means that your internal testing doesn’t test the app as you end up distributing it to your customers.

Thank you very much for the detailed explanation. Your answer clarified that the behavior is intentional --- the AAC capability is restricted to specific distribution channels --- and we will proceed accordingly.

We plan to transition our testing environment to use an App Store Organization team account, following the recommended path of Apple Distribution + TestFlight for internal testing.

(As a side note: it is a bit unfortunate that we won't be able to use our internally built stage-based automated build/distribution pipeline for this workflow, but we understand the policy.)

One piece of feedback I'd like to share regarding the Apple Developer Portal UX:

When downloading an InHouse Distribution Provisioning Profile from the portal, the Enabled Capabilities section displays:

App Groups, Associated Domains, Automatic Assessment Configuration, In-App Purchase, Push Notifications

This listing implies that AAC is included in the downloaded profile. However, as confirmed in this thread, the entitlement key (com.apple.developer.automatic-assessment-configuration) is not actually embedded in the InHouse Distribution profile due to distribution channel restrictions.

This discrepancy between what the portal UI shows and what is actually present in the profile caused significant confusion during our investigation. We had to physically diff the .mobileprovision files to discover the entitlement was missing.

It would greatly reduce developer confusion if the portal clearly distinguished between:

• Capabilities assigned to the App ID (what the portal currently shows), and
• Capabilities actually embedded in the downloaded profile for the selected distribution type.

A simple indicator --- such as a note like "Not available for InHouse distribution" next to restricted capabilities --- would prevent others from going through the same troubleshooting process.

Thank you again for the thorough response and the pointer to the capability restriction guide. Much appreciated.

We plan to transition our testing environment to use an App Store Organization team account

Cool.

we won't be able to use our internally built stage-based automated build/distribution pipeline for this workflow

Keep in mind that you have a bunch of options to automate the TestFlight process, including:

• Command-line tools (xcodebuild, altool, and so on)
• Xcode Cloud
• The App Store Connect API

So while you will need to change your process, you can still automate it.

One piece of feedback I'd like to share regarding the Apple Developer Portal UX:

The best way to get that in front of the right folks is to file it in Feedback Assistant. See Bug Reporting: How and Why? for lots of hints and tips on that process.

Please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"