NEFilterManager saveToPreferences fails with "permission denied" on TestFlight build

I'm working on enabling a content filter in my iOS app using NEFilterManager and NEFilterProviderConfiguration. The setup works perfectly in debug builds when running via Xcode, but fails on TestFlight builds with the following error:

**Failed to save filter settings: permission denied ** **Here is my current implementation: **

• (void)startContentFilter { NSUserDefaults *userDefaults = [NSUserDefaults standardUserDefaults]; [userDefaults synchronize];

  [[NEFilterManager sharedManager] loadFromPreferencesWithCompletionHandler:^(NSError * _Nullable error) { dispatch_async(dispatch_get_main_queue(), ^{ if (error) { NSLog(@"Failed to load filter: %@", error.localizedDescription); [self showAlertWithTitle:@"Error" message:[NSString stringWithFormat:@"Failed to load content filter: %@", error.localizedDescription]]; return; }

        NEFilterProviderConfiguration *filterConfig = [[NEFilterProviderConfiguration alloc] init];
        filterConfig.filterSockets = YES;
        filterConfig.filterBrowsers = YES;
  
        NEFilterManager *manager = [NEFilterManager sharedManager];
        manager.providerConfiguration = filterConfig;
        manager.enabled = YES;
  
        [manager saveToPreferencesWithCompletionHandler:^(NSError * _Nullable error) {
            dispatch_async(dispatch_get_main_queue(), ^{
                if (error) {
                    NSLog(@"Failed to save filter settings: %@", error.localizedDescription);
                    [self showAlertWithTitle:@"Error" message:[NSString stringWithFormat:@"Failed to save filter settings: %@", error.localizedDescription]];
                } else {
                    NSLog(@"Content filter enabled successfully!");
                    [self showAlertWithTitle:@"Success" message:@"Content filter enabled successfully!"];
                }
            });
        }];
    });
  

  }];

}

**What I've tried: ** Ensured the com.apple.developer.networking.networkextension entitlement is set in both the app and system extension.

The Network extension target includes content-filter-provider.

Tested only on physical devices.

App works in development build, but not from TestFlight.

**My questions: **

Why does saveToPreferencesWithCompletionHandler fail with “permission denied” on TestFlight?

Are there special entitlements required for using NEFilterManager in production/TestFlight builds?

Is MDM (Mobile Device Management) required to deploy apps using content filters?

Has anyone successfully implemented NEFilterProviderConfiguration in production, and if so, how?