Xcode failed to create ipa after enabling appgroup feature

I am trying to create an ipa file with a distribution using xCode. Managed to build it successfully.

However, when I enable the "Application Groups" feature in the "Capabilities" tab. I press

Permissions failed, your account does not have permission to create an iOS distribution certificate.

I am currently using XCode Version 8.3.1 (8E1000a).

Update:

Ability to create using an application group name that is similar to the application bundle ID (group.com.xx.appgroupPrototype and com.xx.appgroupPrototype)

However, after adding a new application group (for example, group.com.xx.appgroupPrototype.sandbox), a reject error will occur when creating an IPA.

Question:

From the above, does this mean

1) App group name should be similar to app bundle id

2) We cannot add a new application group name