What Is ~/Library/Group Containers on a Mac, and What Can You Delete?

Open ~/Library/Group Containers on a Mac that has been in use for a while and you will find a column of folders named like UBF8T346G9.Office, group.com.apple.notes or 9K33E3U3T4.net.shinyfrog.bear. Some hold a few kilobytes of settings, some hold an app's whole database, and a few belong to apps you removed long ago. The names read like noise, so people short on space tend to empty the whole folder, and that is where things go wrong.

This post covers what the folder is, how to read the names, how to find out which installed app still uses a group, and which groups an uninstalled app left behind that you can move to the Trash.

What the folder is

An App Group is a shared space a developer declares in an app's code signature, under the com.apple.security.application-groups entitlement. Apple's App Groups entitlement documentation describes it as the way several apps from one development team share containers and keychain access groups and talk to each other. On a Mac each group gets a folder at ~/Library/Group Containers/<group id>, and the system adds Library/Application Support, Library/Caches and Library/Preferences inside it the first time it is used.

Apple lists two identifier formats:

• group.<group name>, registered on the Apple Developer website, the same format iOS uses.
• <team identifier>.<group name>, a macOS format that starts with the developer's ten-character Team ID and needs no registration.

The folder name is the identifier, so a plain listing already tells you which shape each group has.

Why a group outlives the app

One app is rarely the only member. The main app, its widgets, its share or Finder extensions and its helper tools often join the same group so they read the same settings and files. A developer can also put several separate apps in one group: Microsoft's Office apps share UBF8T346G9.ms, UBF8T346G9.Office and UBF8T346G9.OfficeOsfWebHost, and Pages, Numbers and Keynote share group.com.apple.iWork.

Removal is where macOS and iOS part ways. Apple's containerURL(forSecurityApplicationGroupIdentifier:) documentation says that on iOS the system deletes a group directory once every app in the group is gone, while on macOS it creates the directory the first time an app needs it and never removes it. Dragging an app to the Trash leaves its groups exactly where they were.

What is inside varies a lot. It can be a small preferences file, a cache, or real data. Microsoft warns that moving Office's three shared folders to the Trash removes Outlook data, and WhatsApp keeps received media in group.net.whatsapp.WhatsApp.shared and group.net.whatsapp.WhatsApp.private, which can run to tens or hundreds of gigabytes.

Reading the folder names

Two things make this harder than it looks. A Team ID names the developer, not the app: every Microsoft group on the Mac starts with UBF8T346G9., whether it belongs to Teams or to Office. And a name that looks like a bundle id is not always the current app's id: Teams keeps UBF8T346G9.com.microsoft.teams while the app itself is com.microsoft.teams2. The name is a lead. The signatures of the installed apps are the evidence.

Why sorting by size and deleting goes wrong

The largest folders here are usually the ones in use. A size-sorted list puts a mail store, a notes database or a chat app's media at the top, and none of them are caches.

Apple's own apps live here too. group.com.apple.notes and group.com.apple.reminders belong to Notes and Reminders, group.com.apple.iWork to Pages, Numbers and Keynote, and names starting with systemgroup. are system groups. None of these are leftovers, even when you do not recognise the name.

A shared group outlives any one of its members. Removing Word does not make UBF8T346G9.Office disposable while Excel or Outlook is still installed, and deleting it resets or breaks the apps that remain.

Once a group is deleted, nothing brings the contents back. An app that still needs the group gets a new, empty folder the next time it asks for one, but whatever was inside is gone unless you kept a copy.

Finding out who owns a group

Start with a read-only look at what is there and how big it is:

ls ~/Library/Group\ Containers
du -sh ~/Library/Group\ Containers/* 2>/dev/null | sort -h | tail -15

The first line lists every group. The second shows the fifteen largest, biggest last. macOS may ask whether Terminal can access data from other apps; if you decline, or a folder reports a permission error or no size, it has not been measured, which does not make it empty.

Then check which developer signed an installed app and which groups it declares:

codesign -dv "/Applications/Microsoft Teams.app" 2>&1 | grep TeamIdentifier
codesign -d --entitlements - "/Applications/Microsoft Teams.app" 2>/dev/null

The TeamIdentifier line should match the prefix of the groups you suspect. The second command prints the app's entitlements, and the groups it belongs to are listed under com.apple.security.application-groups.

To find every installed app that still declares a particular group, search their signatures:

find /Applications ~/Applications -maxdepth 3 -name "*.app" -prune 2>/dev/null |
while read -r app; do
  codesign -d --entitlements - "$app" 2>/dev/null | grep -qF "UBF8T346G9.Office" && echo "$app"
done

Each line it prints is an app whose own signature claims the group, and that group stays. An empty result is a strong hint, not proof. The loop reads each app's outer signature only, while widgets, extensions and helpers inside an app carry signatures of their own, and it does not look at apps installed outside those two folders.

Which ones are safe to remove

A group is a leftover you can remove when all of these hold:

1. Its name carries the full id of an app you removed, or a Team ID none of your installed apps are signed with.
2. No installed app declares it, checked as above, including apps outside /Applications.
3. It is not an Apple group: nothing starting with group.com.apple. or systemgroup., unless it is the exact group of a separately downloaded Apple app you removed, such as TestFlight.
4. You have looked inside and do not need what is there. A chat app's media or an Outlook store is still yours after the app is gone.

Then quit anything from that developer, move the folder to the Trash in Finder with Go › Go to Folder, and leave the Trash alone for a while before emptying it. If you reinstall the app later, it starts with a fresh group. Removing leftover files after uninstalling covers the rest of ~/Library, and what Mac cleaners should never delete lists the other places that look disposable and are not.

How Mole handles it

Mole only removes group containers while uninstalling an app. It looks for groups named after that app's bundle id, groups carrying its Team ID, and groups declared in the signatures of the app and the extensions, login items, XPC services and helpers inside it. A group.<bundle id> folder named exactly after the app is selected by default. A <TeamID>.<bundle id> folder, a group that only starts with the app's id, or a shared group the app declares is listed without a tick, and a group that a still-installed app with a longer, more specific id owns is not listed at all.

Right before each group moves, Mole checks again. It rereads the installed apps from the same developer and the active System Extensions, and refuses the group if any of them declares it, if the app it reviewed has changed or been reinstalled, or if that inventory cannot be read in time. A yes for one row is never reused for the next. Apple's group.com.apple. groups stay protected apart from the exact group of a separately distributed Apple app such as TestFlight, so removing Pages leaves group.com.apple.iWork for Numbers and Keynote. When I removed Microsoft Teams on a test Mac, three groups stayed, UBF8T346G9.com.microsoft.teams, UBF8T346G9.com.microsoft.oneauth and UBF8T346G9.com.microsoft.entrabroker, and Mole reported them as protected rather than guessing. Office's UBF8T346G9.Office and its siblings are left alone on purpose.

Everything an uninstall removes goes to the Trash. Outside an uninstall, Group Containers is on Mole's list of protected user-data locations. The leftovers section in Clean never offers group. or shared groups; the only group containers it can list are per-app <TeamID>.<bundle id> folders whose id no installed software claims, and it lists none when that check cannot finish. For the rest of the cleanup picture, see which Mac caches are safe to delete and the Office uninstall guide.

FAQ

Can I delete the whole Group Containers folder?

No. It holds data for apps that are still installed, including Notes, Reminders, iWork and whatever mail or chat apps you use. Remove individual groups only after checking that no installed app declares them.

Why is a group still there after I uninstalled the app?

On macOS the system creates a group folder when an app first needs it and never removes it, and the same group may still be in use by another app or extension from that developer. Dragging the app to the Trash does not touch it.

What happens if I delete a group an installed app still uses?

The app loses whatever was inside, such as settings, sign-in state or local data, and gets an empty folder the next time it asks for one. Move groups to the Trash rather than deleting them outright, so you can put one back if an app stops working.