Most of what’s written online about eSIM is about holidays. Should you buy an Airalo for Spain. Whether Holafly works in Japan. How to scan a QR code at the airport.
This isn’t that.
Modern smartphones, tablets, laptops, smartwatches and connected vehicles are increasingly shipping without a physical SIM tray – and the same underlying technology that lets a tourist activate a 7-day data plan also lets a global enterprise run thousands of corporate devices across 200+ countries on a single licence. Same tech. Completely different problem to solve.
This guide unpacks how eSIMs actually work – the eUICC chip, the GSMA standards that govern it, and the remote SIM provisioning process that makes it all possible. Then it explains why the architecture that powers a consumer travel eSIM is the same architecture that, deployed properly, replaces the entire mobile estate of an enterprise.
From plastic SIM to embedded chip
Traditional SIM cards – from the original full-size SIM down to today’s nano-SIM – are removable, single-purpose plastic cards. Each one carries a chip pre-loaded with a single mobile operator’s profile. Want to change network? Order a new SIM. Wait for it to arrive. Swap it in. Repeat for every device, every time.
An eSIM is different. The “e” stands for embedded – the SIM is a small chip soldered directly into the device during manufacturing. You can’t remove it. You don’t need to.
The chip itself is called an eUICC: embedded Universal Integrated Circuit Card. It’s a hardware component, but the real intelligence isn’t the chip – it’s the software architecture sitting on top of it.
Where a traditional SIM is hard-wired to one operator, an eUICC is designed to hold multiple operator profiles, downloaded over the air, swapped in and out remotely. One physical chip, many possible network identities.
This is where the consumer and enterprise paths diverge. A holidaymaker in Lisbon scans one QR code, gets one local data plan, deletes it when they fly home. An enterprise IT team is doing the same thing for 500 devices across 30 countries, with policies, spend caps, audit trails and remote revocation – all from one console. The chip is identical. What sits on top is what separates a £15 holiday data pack from a managed connectivity platform.
The four moving parts of remote SIM provisioning
The standardised process for getting a profile onto an eSIM is called Remote SIM Provisioning (RSP), and it’s governed by the GSMA – the global trade body that sets the rules for mobile networks.
Four components do the heavy lifting:
1. The eUICC. The chip in the device. It’s a secure element that stores operator profiles and runs the cryptographic operations needed to authenticate with networks.
2. The SM-DP+ (Subscription Manager Data Preparation Plus). The server, run by or on behalf of a mobile operator, that prepares and protects the operator profile before sending it to the device. Think of it as the secure pharmacy that dispenses your network credentials.
3. The SM-DS (Subscription Manager Discovery Service). A discovery server that tells the device where to find a pending profile when no QR code or activation URL is provided. Particularly important for IoT devices that have no screen.
4. The LPA (Local Profile Assistant). Software running on the device itself that orchestrates the download, installation and switching of profiles. On a phone, this is what you interact with through the eSIM settings menu.
When you scan a QR code or enter an activation code to set up an eSIM, here’s what’s actually happening:
-
- The LPA on your device reads the activation code and contacts the SM-DP+ named in it.
-
- The SM-DP+ verifies the eUICC’s identity using a cryptographic certificate baked in at manufacture.
-
- The operator profile is encrypted, sent to the device over a secure channel, and installed inside a protected partition of the eUICC.
-
- The profile is activated. The device now connects to that operator’s network exactly as if a physical SIM had been slotted in.
The whole process typically takes 30 to 90 seconds. No SIM swap. No shipping. No IT desk visit.
GSMA eSIM standards: SGP.22 vs SGP.32
Two GSMA standards govern how eSIMs work in practice, and the difference matters more than vendors let on:
SGP.22 is the consumer eSIM specification. It assumes a person, with a smartphone, scanning a QR code and making a deliberate choice. This is what powers Apple, Google and Samsung’s eSIM flows on the devices in your team’s pockets.
SGP.32 is the IoT eSIM specification, finalised in 2023 and now rolling out across the IoT industry. It’s designed for devices that have no screen, no user, and no easy way to scan a QR code – smart meters, vehicle telematics units, asset trackers, EPOS terminals. SGP.32 introduces a new IoT remote SIM provisioning architecture (IPA and eIM) that lets a fleet manager push profiles to thousands of devices at once, with no human in the loop.
Here’s the bit most enterprise buyers miss. If a vendor pitches you “enterprise eSIM” but their architecture is pure SGP.22, what they’re really selling is a consumer travel app dressed up with a corporate invoice. Workforce devices use SGP.22. Connected assets use SGP.32. A serious enterprise platform supports both – not because the standards are interchangeable, but because most enterprises end up needing both.
Multi-profile and multi-network: the enterprise unlock
Because the eUICC can hold multiple profiles, a single device can carry several network identities at once – and switch between them based on signal strength, cost, policy, or network failure.
A traditional SIM gives you a single connection to a single carrier. If that carrier’s coverage drops in a particular building, postcode or country, your team is offline.
An eSIM-based platform can hold profiles from multiple networks on the same chip – in the UK that’s all four major operators (EE, O2, Three and Vodafone), and globally over 450 carrier networks. If one network drops, the device switches to another. Your team stays connected. Your IT team gets visibility into what’s happening, in real time, before tickets get raised.
This is the single biggest reason enterprise eSIM is structurally different from a traditional business mobile contract. You’re no longer hostage to one carrier’s coverage map. And crucially, this is a capability consumer travel eSIMs simply don’t offer. They give you one network, in one country. Take it or leave it.
What “Over-The-Air deployment” actually means in practice
The phrase gets thrown around a lot. What it actually means day-to-day:
-
- No physical logistics. No SIM cards in envelopes. No couriers. No “I lost the SIM in transit” tickets.
-
- Instant provisioning. A new starter joins on Monday. You assign them an eSIM profile from the management console. They activate it on their phone in under a minute.
-
- Remote revocation. Someone leaves the business. You revoke the profile from the platform. The device is no longer authenticated on your account. No SIM to chase, no card to destroy.
-
- Travel-ready. An exec is flying to Singapore on Wednesday. You push a regional data profile to their device on Tuesday afternoon. They land with full connectivity, no roaming negotiation, no third-party app to install.
-
- Bulk operations. Provision 500 new field engineers in an afternoon. Try that with plastic SIMs.
For enterprise IT teams, connectivity becomes a software-defined resource you manage centrally, in real time, like any other identity or licence.
Security: why eSIMs are harder to attack than physical SIMs
Traditional SIMs have two well-known weaknesses.
They can be physically stolen and inserted into another device. And they’re vulnerable to SIM-swap fraud, where an attacker socially engineers a carrier into transferring a victim’s number onto a SIM card they control.
eSIMs change the equation:
-
- Profiles are tied to a specific eUICC by cryptographic certificate. They cannot be physically removed and moved to another device.
-
- All provisioning happens over a mutually authenticated, encrypted channel between the SM-DP+ and the eUICC.
-
- Enterprise eSIM platforms can enforce policy at the platform layer – blocking unauthorised profile changes, restricting which networks a device can connect to, and revoking access in seconds.
Combined with platform-level controls (spend caps, business-only data profiles, location awareness), a properly managed enterprise eSIM estate has a materially stronger security posture than the equivalent traditional SIM estate.
What this looks like in practice
The pattern’s worth grounding in something real.
A global multinational with operations across Asia, the Middle East and Sub-Saharan Africa came to us with a familiar set of problems. Roaming bills arriving days after the spend, with no way to flag overruns at source. No mechanism to enforce usage policy on devices once they crossed a border. Travelling staff arriving on the ground unable to confirm whether their device would even connect. The kind of issues every multi-region enterprise recognises – and most accept as the cost of doing business.
A six-week proof of concept ran a UK-based traveller cohort across priority destinations to validate coverage before any wider commitment. From there, deployment was pushed out across users in Japan, the Middle East and Sub-Saharan Africa, with eSIM provisioning done entirely over the air. No physical SIMs shipped. Business profiles applied through Fortigate. MDM integration handled the lifecycle.
Twelve months in, the numbers:
-
- 40% reduction in roaming spend.
-
- 100% reduction in bill shock incidents.
-
- ~15 seconds data visibility latency, against the multi-day billing lag they had previously.
-
- <5 minutes average eSIM deployment time, over the air.
“The ability to deploy over the air, test connectivity before travel and ensure mobile service on arrival has been especially valuable.”
– Communications Service Manager, Global Multinational
That last point is the one most enterprise IT teams underestimate. Not the cost saving. Not even the visibility. The ability to test that a device will actually work in Riyadh before someone gets on the plane to Riyadh. That’s the gap consumer eSIM has never tried to solve – because no holidaymaker is briefing IT on a Tuesday for a Wednesday flight.
What this means for your business
If you’re an IT, Finance or HR leader evaluating mobile connectivity, the takeaway is straightforward:
eSIM is not just a different form factor for the SIM card. It’s the foundation of a fundamentally different operating model for enterprise mobile connectivity – one with central control, real-time visibility, multi-network resilience, and zero physical logistics.
But the technology alone isn’t the answer. Without a management platform on top, you’ve just got a chip. The value comes from how that chip is provisioned, monitored, controlled and billed at enterprise scale.
FAQ
What is the difference between an eSIM and a SIM card?
A traditional SIM card is a removable plastic card containing one operator profile. An eSIM is a chip embedded in the device at manufacture (called an eUICC) that can hold multiple operator profiles, downloaded and switched remotely with no physical swap.
What is an eUICC?
An eUICC (embedded Universal Integrated Circuit Card) is the physical chip that makes eSIM technology work. It’s soldered into the device and securely stores one or more operator profiles, which can be added, switched or removed over the air.
What is Remote SIM Provisioning?
Remote SIM Provisioning (RSP) is the GSMA-standardised process for delivering an operator profile to an eSIM-enabled device over the air. It uses four components – the eUICC, the SM-DP+ server, the SM-DS discovery service, and the LPA software on the device.
What is the difference between GSMA SGP.22 and SGP.32?
SGP.22 is the consumer eSIM specification used by smartphones, tablets and laptops, and assumes a user scanning a QR code. SGP.32 is the IoT eSIM specification, designed for screen-less devices where profiles are pushed to fleets remotely without user interaction.
Are eSIMs more secure than physical SIMs?
Generally yes. eSIM profiles are tied cryptographically to a specific device chip and cannot be physically removed. Provisioning is encrypted and mutually authenticated. Enterprise platforms add policy controls and instant remote revocation, providing a stronger security posture than traditional SIM estates.
Is enterprise eSIM the same as a travel eSIM?
No. Travel eSIMs (Airalo, Holafly etc.) are consumer products – one network, one country, one trip. Enterprise eSIM platforms manage multi-network connectivity across hundreds of countries on a single licence, with policy controls, spend caps, audit trails and remote revocation managed centrally by IT.
