You’re right in identifying that Xcode’s target settings for App Groups aren’t scheme- or build-configuration-specific—they’re project-wide and tied to the target. So, even though your code picks the correct App Group identifier based on the environment, Xcode’s signing and capabilities system only knows about the App Groups you check in the target settings.

Here’s what you need to know:

1. All App Groups must be enabled in target settings:
   In your target’s “Signing & Capabilities” > App Groups section, check all the App Groups your various flavors use (Development, Staging, Production).

   • This setup ensures the provisioning profile Xcode generates will include entitlements for all your App Groups, preventing runtime entitlement errors as long as your app/extension is accessing one of the allowed groups.

2. Selecting a group per scheme is not possible in Xcode UI:
   The checkboxes in the target’s capabilities correspond to the entitlements applied to all configurations/schemes for that target. Schemes themselves cannot change entitlements (nor can build configurations directly).

3. Environment-specific access is controlled in code:
   It’s fine (and quite common) to conditionally select which App Group identifier you use at runtime based on the environment. As long as all possible App Groups are listed in your entitlements, this is a safe and accepted practice.

4. Provisioning profiles:
   In the Apple Developer portal, make sure all the App IDs (for each environment) have access to their appropriate App Groups, and that your provisioning profiles are up to date and include all App Groups required by the app and any extensions.

5. Potential pitfalls:

   • If you remove an App Group from the target’s capabilities, Xcode may also update your provisioning profile to drop it, which could break one or more flavors.

   • Xcode will never allow you to dynamically select an App Group at build time via schemes/configurations in the Xcode UI—it’s always a superset at the target level.

Summary / TL;DR:

• Check all relevant App Groups in your target’s “Signing & Capabilities.”

• Use runtime logic in your app and extension to select the correct App Group per environment.

• Maintain correct mapping in the Developer portal and provisioning profiles.

• It’s safe as long as you do not access App Groups not listed in entitlements, and all flavors’ App IDs are granted access to the App Groups.

Extra tip:
If you add or remove App Groups in the Developer portal, always update your provisioning profiles and regenerate them in Xcode to ensure all entitlements are synced.