diff --git a/Sources/XKit/DeveloperServices/App IDs/DeveloperServicesAddAppOperation.swift b/Sources/XKit/DeveloperServices/App IDs/DeveloperServicesAddAppOperation.swift
index d726e91e..23aca94b 100644
--- a/Sources/XKit/DeveloperServices/App IDs/DeveloperServicesAddAppOperation.swift	
+++ b/Sources/XKit/DeveloperServices/App IDs/DeveloperServicesAddAppOperation.swift	
@@ -13,6 +13,7 @@ public struct DeveloperServicesAddAppOperation: DeveloperServicesOperation {
 
     public enum Error: LocalizedError {
         case invalidApp(URL)
+        case tooManyAppGroups(bundleID: String, count: Int)
 
         public var errorDescription: String? {
             switch self {
@@ -24,6 +25,16 @@ public struct DeveloperServicesAddAppOperation: DeveloperServicesOperation {
                         ), $0
                     )
                 }
+            case .tooManyAppGroups(let bundleID, let count):
+                return bundleID.withCString {
+                    String.localizedStringWithFormat(
+                        NSLocalizedString(
+                            "add_app_operation.error.too_many_app_groups",
+                            value: "%s requests %d app groups, but free teams can only use one app group per app",
+                            comment: ""
+                        ), $0, count
+                    )
+                }
             }
         }
     }
@@ -180,6 +191,10 @@ public struct DeveloperServicesAddAppOperation: DeveloperServicesOperation {
                 // re-assign rather than using updateEntitlements since the latter will
                 // retain unrecognized entitlements
                 let filtered = try entitlements.entitlements().filter { $0.anyCapability?.isFree != false }
+                if let groups = filtered.lazy.compactMap({ $0 as? AppGroupEntitlement }).first?.rawValue,
+                    groups.count > 1 {
+                    throw Error.tooManyAppGroups(bundleID: bundleID, count: groups.count)
+                }
                 entitlements = try Entitlements(entitlements: filtered)
             }
         } else {
diff --git a/Sources/XKit/DeveloperServices/App IDs/Entitlements/DeveloperServicesCapability.swift b/Sources/XKit/DeveloperServices/App IDs/Entitlements/DeveloperServicesCapability.swift
index 2dca4637..9af5eb65 100644
--- a/Sources/XKit/DeveloperServices/App IDs/Entitlements/DeveloperServicesCapability.swift	
+++ b/Sources/XKit/DeveloperServices/App IDs/Entitlements/DeveloperServicesCapability.swift	
@@ -73,9 +73,7 @@ extension DataProtectionEntitlement: EntitlementWithCapability {
 
 extension AppGroupEntitlement: EntitlementWithCapability {
     var capability: DeveloperServicesCapability {
-        // FIXME: Enable app groups on free accounts
-        // but we need to always assign only one group
-        DeveloperServicesCapability(.appGroups, isFree: false)
+        DeveloperServicesCapability(.appGroups, isFree: true)
     }
 }