macOS 27 Denies Cross-Team Container Access Without Asking

On macOS, containerURL(forSecurityApplicationGroupIdentifier:) returns a valid-looking URL for an app group you have no entitlement for. Apple documents this plainly: on iOS the method returns nil for an invalid identifier, but in macOS “a URL of the expected form is always returned, even if the app group is invalid.”4 In macOS 27, that behavior collides with a new restriction.

macOS 27 stopped asking the user before denying cross-team container access. Reading files in another developer team’s app data container or app group container previously produced an authorization prompt. It now fails by default, recoverable only if the user finds the entry in Privacy & Security.1

Those two facts compose into a failure with no signal at the point of failure. No dialog appears. The method returns a URL rather than nil. The path looks exactly like the one you expected. The denial surfaces later, at the file operation, where it reads as a missing file.

TL;DR

macOS 27 removes the user-authorization prompt for accessing other teams’ app data and app group containers, and denies such access by default, with user control moved to Privacy & Security settings.1 The change is filed under System Integrity Protection as a new feature, not a bug fix. Apple’s own guidance on app group containers still describes the prompt behavior that macOS 27 removed. Because the macOS API returns a well-formed URL even for groups you cannot access, the denial appears at read time rather than at the API call. Same-team access is unaffected: the boundary is the Team ID.

What Changed

The macOS 27 release notes carry one sentence under System Integrity Protection:1

“Accessing files in other developer teams’ app data containers and app group containers no longer prompts the user for authorization; such accesses are denied by default and can be managed by the user in Privacy & Security settings.”

Radar 161835690. Two clauses, two separate changes.

The first clause removes a prompt. The second establishes…