I find containerURLForSecurityApplicationGroupIdentifier can do work both on real device and simulator with xcode 6.2. I came across into this thread because i also got nil, but now i find the root cause is my typing error of the 'App Groups' name.
More, here is the list you need check:
- make sure 'app groups' been created either by xcode or web console at https://developer.apple.com
- make sure the 'app groups' is 'enabled' on 'Development' and 'Production' at 'web console: Identifiers->App IDs'
- make sure the matched 'Provisioning Profiles' are 'active'
- the groups name of entitlement in both containing app and extension app should match the one you created in step 1
- make sure the bundle identifier of all targets is the same as the one from 'web console: Identifiers->App IDs
- make sure the 'Team' inside of all targets matches the one from web console
- make sure to pick the correct group under 'Capabilities' tab on both containing app and extension app target, and no red color
- clean up xcode cache by cmd+shift+k
- rebuild and pray