When most people set up an eSIM, they think they’re “installing the eSIM”. They’re not. They’re installing a profile. The eSIM – the chip itself – was already there, soldered to the device’s motherboard at the factory.
That distinction sounds pedantic. It isn’t.
It’s the whole reason enterprise eSIM works.
The profile is the unit you actually manage. The thing IT provisions. The thing Finance applies spend caps to. The thing that gets revoked when someone leaves the business. Understand profiles, and you understand the entire control surface that separates a managed corporate connectivity platform from a consumer travel app.
This guide explains what an eSIM profile actually is, the different types you’ll encounter, and why “Business Profiles” – the policy-controlled flavour – are the thing that turns a chip into a managed corporate resource.
The chip versus the profile: getting the terminology right
In a previous post we covered how an eSIM actually works – the eUICC chip, the GSMA standards, the remote provisioning flow. The chip itself is fixed: one piece of silicon, soldered to the device, never coming out. What’s not fixed is what runs on it.
That’s the profile. An eSIM profile is the digital configuration that holds an operator’s credentials, the network rules the device follows, and (in the enterprise case) the policy controls applied by the business that owns the device.
One chip. Multiple profiles possible. Typically a modern eUICC can hold 5 to 15 profiles simultaneously, though only one tends to be active at any moment. Switching profiles is instant – no re-provisioning, no carrier intervention, no SIM swap.
This matters because every conversation about eSIM management is really a conversation about profile management. Provisioning a device means delivering a profile to it. Revoking a device means killing its active profile. Roaming policy means swapping or switching profiles based on rules. The profile is the verb.
The three types of eSIM profile
Most consumer users only ever encounter one of these. Enterprise platforms work with all three.
1. Operational profile. The day-to-day profile carrying the device’s actual working credentials. This is the one a traveller activates from a QR code. It’s the one a corporate user runs on their work phone. When people say “my eSIM”, they mean their Operational profile.
2. Provisioning profile. A bootstrap profile, usually pre-loaded at manufacture, that exists for one job: get the device online long enough to download its real Operational profile. Critical for IoT devices that ship without knowing which network they’ll be deployed on – the Provisioning profile gives them just enough connectivity to phone home and receive their proper configuration.
3. Test profile. Used by manufacturers and developers to validate device behaviour without burning real network credentials. Most enterprises will never see one directly, but they’re how the device they bought was tested before it shipped.
Open profiles versus Business profiles: where the control lives
This is where the line between consumer and enterprise eSIM gets sharp.
An Open profile is the standard consumer configuration. Travel eSIMs from the likes of Airalo or Holafly are Open profiles. So is the eSIM you’d activate directly with EE or Vodafone on a personal plan. They support a small handful of operations:
- Enable
- Disable
- Delete
And that’s effectively it. There’s no policy layer. No central authority controlling the device’s behaviour. No spend caps enforced at the network level. If the user blows through their data allowance in Dubai, the bill arrives later. If they lose the device, the operator can suspend the line but there’s no audit trail of what the profile was doing, where, or with whom.
A Business profile – sometimes called a Managed profile – is a different proposition. It carries the same underlying credentials, but it’s wrapped in policy metadata that an enterprise platform can read, write and enforce. That metadata is what unlocks central control:
- Spend caps enforced at the platform layer, not after the fact.
- Zone-based rules – force a specific carrier in a specific country, or block roaming entirely outside agreed regions.
- Time-bound profiles that expire automatically (useful for contractors, secondments, short-term assignments).
- APN restrictions to keep corporate traffic on a corporate gateway.
- Audit trail of every profile change, swap, enable and disable.
- Remote revocation triggered from the management console in seconds.
- Integration with MDM, corporate firewalls and identity systems.
Same chip. Same underlying GSMA standards. Wildly different operational reality.
This is the bit consumer eSIM never tries to compete on, because it doesn’t need to. A traveller doesn’t care about audit trails. An IT director running 2,000 devices across 40 countries cares about little else.
How SureSIM exposes this: Open and Business as two policy modes
There’s an issue worth flagging. Inside an enterprise eSIM platform, “Open” and “Business” don’t only mean consumer-versus-managed. They also show up as two distinct policy modes you can apply to a managed profile – same Business-profile architecture underneath, different access rules layered on top.
SureSIM is a useful worked example, because the distinction is exposed directly in the product.
- Open mode: full internet access. The user gets everything a normal mobile connection allows – streaming, social platforms, personal email, general browsing. The platform still enforces spend caps, zone rules, audit trail and remote revocation. The data routes themselves are unrestricted.
- Business mode: traffic restricted to the corporate productivity stack – Microsoft 365, Teams, Outlook, Zoom, CRM platforms, approved business sites. No streaming. No social. No personal data leakage onto the corporate connectivity bill.
Same managed profile. Same eUICC chip. Two operating modes, assignable per user group and switchable in near real time without touching the device. A regional sales lead gets Open mode because they need WhatsApp and LinkedIn on the road. A short-term contractor in a high-spend region gets Business mode because the only thing they need to reach is the company stack. The estate stays under control either way.
That granularity is the difference between policy on paper and policy that actually changes the invoice. The consumer eSIM alternative is to pick one mode at activation and live with whatever the operator decided to give you.
What profile policy actually lets you enforce
“Policy” is one of those words that gets thrown around without ever landing. Concretely, here’s what a properly designed Business profile lets a business do:
- Cap data spend per device, per region, per month. Triggered at the platform – the device simply stops being able to consume metered data when the cap hits. No “oh, we’ll credit you back” three weeks later.
- Force a preferred carrier in a specific zone. A field engineer in Lagos doesn’t get to pick which network they connect to. The policy decides, based on coverage data and cost.
- Restrict access by country. A device cleared for use in the EU shouldn’t suddenly be live on a Russian network. Geo-rules block it.
- Time-bound the entire profile. A six-month consultant’s device profile dies on day 181 without anyone having to remember to switch it off.
- Force corporate APN. All mobile data is routed through the business’s gateway, where existing security policy applies. No bypass via mobile.
- Block voice or SMS where data-only is the policy. Useful for IoT and for tightly controlled fleets.
Every one of those is a decision that, on a traditional SIM estate, either can’t be enforced at all or requires a phone call to the operator’s account manager and a four-week service request.
The lifecycle of a business eSIM profile
A Business profile doesn’t live in stasis. It moves through stages, and each stage is controllable from the platform:
Provision. The profile is created in the management console and assigned to a device. The user receives an activation code (or, for IoT, the profile is pushed remotely).
Activate. The profile downloads to the eUICC over the air and becomes available. From this point, policy is live.
In-life management. The profile is monitored. Policy can be updated remotely – spend caps adjusted, zones added, time-bounds extended. The profile may be swapped onto a different network if conditions change, or held in standby behind a primary profile as a failover.
Suspend. A temporary state. The profile is paused without being destroyed – useful for staff on extended leave, devices in temporary storage, or compliance holds.
Revoke. Permanent. The profile is killed and removed from the eUICC. The device is no longer authenticated on the corporate account. No physical SIM to recover, no card to destroy, no operator escalation.
This lifecycle is what enterprise IT teams mean when they describe eSIM as “software-defined connectivity”. The profile is a resource, like a licence or an identity. It’s created, managed, modified, suspended and destroyed centrally, on the same operational rhythms as any other corporate asset.
What this looks like in practice
Worth a brief, grounded example.
In a recent deployment for a global multinational operating across Asia, the Middle East and Sub-Saharan Africa, the IT team used Business profiles to apply zone-specific rules across high-risk roaming regions. The profile policy was integrated with the company’s existing Fortigate corporate firewall, and the broader device lifecycle was handled through MDM integration.
The effect: bill shock incidents dropped to zero. Not because spend was monitored more aggressively – because the profile policy stopped overruns at source before they could happen. The data visibility latency went from days (waiting for carrier invoices) to under fifteen seconds (real-time platform telemetry).
“The ability to deploy over the air, test connectivity before travel and ensure mobile service on arrival has been especially valuable.”
– Communications Service Manager, global multinational
None of this is doable on Open profiles. None of this is doable on a consumer travel eSIM, no matter how many you stitch together. It’s a function of the Business profile architecture itself.
What this means for your business
The headline:
The eSIM profile is the control surface. Without Business profiles, you don’t have enterprise eSIM – you have consumer eSIM with a corporate invoice attached. The technology may look similar from the device end. The operating model is completely different.
When evaluating an enterprise eSIM platform, the practical question to ask isn’t “do you support eSIM?”. The answer to that is always yes. The question is: “What policy can your Business profiles actually enforce, in real time, across our regions, on our existing IT stack?” The gap between vendors on that question is enormous – and it’s the difference between a managed estate and a billing surprise.
That’s the layer that matters.
FAQ
An eSIM profile is the digital configuration that sits on the eUICC chip and holds an operator’s network credentials, policy rules and connection settings. The chip itself is permanent hardware – the profile is the configurable unit that IT teams provision, manage and revoke.
Modern eUICC chips can hold multiple profiles simultaneously – typically between 5 and 15, depending on the chip specification. Only one profile is usually active at a time, but devices can switch between stored profiles instantly without re-provisioning.
In the consumer eSIM world, an Open profile is the standard unmanaged configuration – one operator, basic enable and disable controls, no central management. A Business profile (also called a Managed profile) adds a policy layer: spend caps, zone rules, audit trails, remote revocation and integration with corporate IT. Within an enterprise platform like SureSIM, Open and Business also refer to two policy modes – Open mode allows full internet access, Business mode restricts traffic to the corporate productivity stack (Microsoft 365, Teams, Outlook, Zoom, CRM).
A Provisioning profile is a bootstrap configuration used to get a device online so it can download its real working profile. An Operational profile is the day-to-day profile carrying the device’s full operator credentials. A Test profile is a third type used in manufacturing and development environments.
Yes. Business profiles managed through an enterprise eSIM platform can be revoked from a central console at any time, instantly disconnecting the device from the corporate account. There is no physical SIM to recover and no carrier intervention required.
Yes. Business profiles support platform-level spend caps that block further data usage once a threshold is reached, eliminating bill shock at source rather than discovering it days later on a carrier invoice.
