Should Enhanced Security entitlements use string values or Boolean true for Mac App Store submission?
Hi,
I’m hoping someone can help clarify the correct entitlement format for the Enhanced Security capability in a macOS App Store build.
Context
Our app is a sandboxed macOS app built with Xcode 26.4. We enabled the Enhanced Security capability in Signing & Capabilities, and we configured the entitlements based on the current documentation.
What’s confusing me
The Xcode 26.4 release notes say apps that already adopted Enhanced Security should remove:
com.apple.security.hardened-process.enhanced-security-versioncom.apple.security.hardened-process.platform-restrictions
and replace them with:
com.apple.security.hardened-process.enhanced-security-version-stringwith value1com.apple.security.hardened-process.platform-restrictions-stringwith value2
Reference: https://developer.apple.com/documentation/xcode-release-notes/xcode-26_4-release-notes
The entitlement reference pages also seem consistent with that:
- https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.security.hardened-process.enhanced-security-version-string
- https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.security.hardened-process.platform-restrictions-string
So our app currently uses the new -string entitlements with values "1" and "2".
Our App Review rejection said:
The app incorrectly implements sandboxing, or it contains one or more entitlements with invalid values.
Entitlement "com.apple.security.hardened-process.enhanced-security-version-string" value must be boolean and true.
Entitlement "com.apple.security.hardened-process.platform-restrictions-string" value must be boolean and true.
That’s the part I can’t reconcile with the documentation.
Questions
- For a Mac App Store submission built with Xcode 26.4, should these two entitlements use the new string-based form, or Boolean
true? - If the expected format has changed, is there any updated guidance beyond the Xcode 26.4 release notes and current entitlement reference?
If Apple staff or anyone familiar with this can clarify what format is currently expected, I’d really appreciate it.
Thanks.
This sounds like a bug in the App Store Connect app checking system. The -string entitlement values must be strings, because that format changes is what allows for back deployment.
Please file a bug against App Store Connect. Once you’re done, reply here with your bug number and I’ll take action from there.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
For reference, I’m attaching screenshots of:
- the App Review message that says these entitlements must be boolean and true, and
- the Xcode 26.4 release note section that says to use the new
-stringvariants with values1and2.
These are the two pieces of guidance I’m trying to reconcile.
👁 Screenshot 2026-04-02 at 9.44.44 PM.png
A quick update from my side:
After receiving the App Review guidance, I tried changing both of these entitlements from the documented string values to Boolean true:
com.apple.security.hardened-process.enhanced-security-version-stringcom.apple.security.hardened-process.platform-restrictions-string
In local testing, that change caused the app to fail to launch on both macOS and iOS.
I then changed them back to the documented string values ("1" and "2"), and the app immediately launched normally again.
So at least in my current Xcode 26.4 / OS 26.4 environment, the Boolean form appears to break launch, while the string-based form works normally.
A quick update from my side:
After receiving the App Review guidance, I tried changing both of these entitlements from the documented string values to Boolean true:
com.apple.security.hardened-process.enhanced-security-version-stringcom.apple.security.hardened-process.platform-restrictions-string
In local testing, that change caused the app to fail to launch on both macOS and iOS.
I then changed them back to the documented string values ("1" and "2"), and the app immediately launched normally again.
I also created a brand-new Xcode 26.4 project and enabled the Enhanced Security capability there. Xcode generated these two entitlements as String values (1 and 2) by default in the new project as well.
So at least in my current Xcode 26.4 / OS 26.4 environment, the string-based form appears to be both the Xcode default and the only form that launches normally in testing.
This sounds like a bug in the App Store Connect app checking system. The -string entitlement values must be strings, because that format changes is what allows for back deployment.
Please file a bug against App Store Connect. Once you’re done, reply here with your bug number and I’ll take action from there.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"