GSMA eSIM IoT Technical Specification
SGP.32 is the GSMA specification for remote SIM provisioning on IoT devices. It solves the problem that stalled eSIM adoption for a decade - how to manage millions of headless, low-power devices without physical SIM swaps, user interfaces, or QR codes.
How eSIM got here
The story starts in 2010 with a simple industrial problem and ends with a standard reshaping how the entire IoT industry thinks about connectivity.
2010 - 2013
The automotive industry needed to manage SIM profiles remotely - primarily for connected cars manufactured for global markets. The GSMA response was SGP.02, the first M2M eSIM standard. It worked for automotive: high-value, well-connected devices. But for the coming wave of low-cost, low-power IoT devices deployed in their millions, it was already the wrong answer. SM-SR dependencies, operator lock-in, and heavy provisioning requirements made it impractical at scale.
2016 - 2018
SGP.22 transformed connectivity for smartphones and tablets. The Local Profile Assistant model let users download and switch profiles using a QR code or app. Elegant for devices in human hands. For IoT it was a dead end. The entire architecture assumed a user was present to initiate every profile change. Deployed in a remote utility meter or livestock tracker, SGP.22 was impractical at best and impossible at worst.
2020 - 2022
IoT deployments were scaling fast. Two billion connected devices. Yet eSIM adoption outside automotive remained near zero. SGP.02 demanded complex SM-SR infrastructure and operator lock-in. SGP.22 demanded a user. Neither standard was built for constrained networks, no user interface, and thousands of devices to manage at once.
May 2023
The GSMA published SGP.31 (architecture) followed by SGP.32 (technical specification). The eIM replaced the SM-SR. The IPA replaced the LPA. Profile management became server-driven, lightweight, and designed to work on NB-IoT and LTE-M via CoAP over UDP. For the first time, there was an eSIM standard actually built for IoT.
2024 - Now
SGP.32 v1.2 is the current specification. Certified modules are reaching the market. The GSMA estimates 195 million SGP.32 profile downloads by 2029 - 70% of all IoT eSIM activity. Most devices in the field still run SGP.02 or SGP.22, but the transition is real and accelerating.
What actually changed
SGP.32 represents three fundamental architectural changes that together make remote IoT SIM management practical for the first time.
Every previous eSIM standard required the device or user to pull profile changes. SGP.32 inverts this. The eIM pushes changes from the server, allowing operators to manage fleets of thousands without any device-side interaction.
The SM-SR under SGP.02 locked enterprises to single operators. SGP.32 replaces it with the eIM - separating profile preparation from delivery management and creating genuine multi-operator flexibility for the device lifetime.
SGP.22 relied on HTTPS. NB-IoT devices often have kilobyte daily data budgets. SGP.32 uses CoAP over UDP with DTLS - profile operations complete with a fraction of the data overhead, making low-power sensors genuinely viable.
What SGP.32 means for your sector
SGP.32 affects different industries differently. The underlying driver is the same - no more physical SIM logistics - but the specific value varies by sector.
Devices with 15-20 year lifespans. SGP.32 allows remote operator switching for the life of the device, and CoAP support makes it viable on the NB-IoT networks most utility meters actually run on.
Operator flexibility over device lifetime
Devices inside machinery in harsh environments, inaccessible without production downtime. SGP.32 eliminates physical SIM management entirely and enables seamless switching between private 5G and public networks.
Zero on-site SIM management
Containers and vehicles cross borders constantly. SGP.32 allows automatic switching to a local operator profile on arrival - no roaming surcharges, no permanent roaming restrictions. One SKU serves every market.
Single SKU global deployment
Battery-powered sensors in remote locations running on marginal coverage. SGP.32 supports asynchronous operations - devices can receive management commands when they next wake from deep sleep, with no always-on connection required.
Low-power asynchronous operation
Why most devices still run SGP.22
SGP.32 was published in 2023. Certified hardware is only now scaling. Most eSIM-capable IoT routers sold today still use SGP.22 - and at least one major manufacturer found a clever way to make that work.
When Teltonika Networks built eSIM into the RUT241 and RUTX series, SGP.32 certified chipsets were not commercially available. SGP.22 infrastructure was already widely deployed, well-tested, and supported by a broad carrier ecosystem. The pragmatic choice was clear.
But Teltonika did not stop at a basic SGP.22 implementation.
Teltonika's Remote Management System adds server-initiated profile management on top of SGP.22. Through RMS, administrators can remotely push eSIM profile changes to individual devices or entire fleets - no device-side user interaction required.
Teltonika describes this as delivering "the best of both worlds: the wide compatibility of SGP.22 with the remote management power of SGP.32." The RUT241 supports up to seven stored eSIM profiles alongside a physical SIM slot, all manageable remotely via RMS.
This is not SGP.32. It does not use the eIM architecture or CoAP provisioning. But for the practical use cases most router deployments face, it delivers comparable operational outcomes on hardware that is available right now.
The Teltonika approach works well for connected routers and gateways - well-powered, always-on devices running HTTPS-based provisioning. Where it cannot follow SGP.32 is in deep constrained IoT: NB-IoT sensors with kilobyte data budgets, devices sleeping for days, ultra-low-power deployments where even an HTTPS session is too expensive.
That is the exact territory SGP.32's CoAP transport and asynchronous IPA were built for. The two approaches are complementary, not competing.
Certified SGP.32 modules from Quectel, Thales (Cinterion), and others are becoming commercially available in 2025-2026. As these modules enter production hardware designs, native SGP.32 deployments will accelerate rapidly.
The transition will not happen overnight - there is a large installed base of SGP.22 devices, and SGP.22 remains perfectly adequate for many use cases. But for new IoT hardware designs targeting NB-IoT, constrained deployments, or genuinely global multi-operator scenarios, SGP.32 is the right foundation.
The technology stack underneath SGP.32
SGP.32 depends on a stack of protocols, each optimised for the constrained environments where IoT devices operate.
CoAP
Constrained Application Protocol
The lightweight alternative to HTTP designed for low-power IoT. SGP.32 uses CoAP over UDP to reduce overhead, making profile management viable on NB-IoT where data budgets are counted in kilobytes.
DTLS
Datagram Transport Layer Security
TLS adapted for UDP. SGP.32 profile operations require cryptographic security - DTLS provides authentication, integrity, and encryption without needing a TCP connection.
NB-IoT
Narrowband IoT
Ultra-low power, deep indoor penetration, small data payloads. Smart meters, utility sensors, and agricultural monitors run on NB-IoT. SGP.32 is the first eSIM standard genuinely viable on this network.
eUICC
Embedded Universal Integrated Circuit Card
The secure element chip that stores and manages SIM profiles. SGP.32 defines how the IoT-device eUICC communicates with the eIM via the IPA, without requiring user interaction.
SM-DP+
Subscription Manager - Data Preparation +
The secure backend profile server. SGP.32 deliberately reuses the SM-DP+ infrastructure already deployed for SGP.22 - lowering the barrier to adoption while the new eIM layer handles orchestration.
LTE-M
LTE Cat-M1
The higher-bandwidth LPWAN standard supporting device mobility. Asset trackers, wearables, and logistics devices use LTE-M. Both NB-IoT and LTE-M are natively supported in SGP.32's constrained-network provisioning model.
Ten cornerstone guides
Ten focused reference guides covering every angle of the standard - architecture, comparisons, hardware, networks, and the future of eSIM.
Pillar Page
Definition, context, capabilities and why it matters for IoT at scale.
Technical Reference
How the three core components interact and what they replace.
Comparison
Why earlier standards failed IoT and exactly what changed with SGP.32.
Hardware Reference
Teltonika, Milesight, Cradlepoint, Quectel, Thales and others - how each delivers eSIM.
Network Guide
The UK network landscape, who owns the profile, and where the real opportunity lies.
Buyer Guide
What eSIM hardware actually delivers for the person installing and running it.
Technical Issue
The fundamental problem with getting an eSIM online before it has a profile, and how it is solved.
Forward Look
Where the standard, the hardware, and the network are heading over the next five years.
Editorial
An honest look at where the real value in eSIM delivery actually sits.
Reference
eIM, IPA, eUICC, SM-DP+, RSP, CoAP, DTLS, SGP.31 and more - all defined clearly.
The UK authority on eSIM and eUICC - consumer, M2M and IoT standards explained