GSMA SGP.32 Updates: Key Changes

Lifestyle

GSMA SGP.32 is the latest standard for managing eSIMs in IoT devices, introduced in 2023. It simplifies remote SIM provisioning by focusing on devices with limited connectivity, such as those using LPWAN networks. Key updates include:

Integrated Profile Agent (IPA) & eSIM IoT Manager (eIM): IPA handles profile switching on devices, while eIM enables remote, centralised management of eSIM profiles for large fleets.
IP-Based Protocols: Replaces SMS triggers with lightweight IP protocols, reducing data usage and improving battery life for low-power devices like sensors.
Security and Scalability: Uses existing eSIM infrastructure to manage millions of devices securely without complex integrations.
Device-SIM Management Separation: Simplifies production and supports global deployment by separating SIM and device management.

SGP.32 Explained: The Next-Gen eSIM Standard for IoT

Key Changes in GSMA SGP.32

SGP.32 vs SGP.02: Key Differences in eSIM IoT Standards

Separate Device and SIM Management

SGP.32 introduces a fresh approach to eSIM profile management by dividing responsibilities into two separate components. The IoT Profile Assistant (IPA) is embedded within the device or SIM card, while the eSIM IoT Manager (eIM) functions as a remote, platform-based tool controlled by enterprises. This split removes the need for the intricate integrations between Subscription Manager Secure Routing (SM-SR) and operator platforms that were a requirement under the older SGP.02 standard.

With this structure, enterprises can now remotely manage profile changes – such as downloading, enabling, disabling, or deleting profiles – across entire fleets of devices without needing manual intervention or assistance from network operators. For manufacturers, this simplifies production: a single hardware design with one eSIM can be customised for any market after production. This separation also lays the groundwork for future advancements in protocol and security under SGP.32.

IP-Based Protocol Support

One of the standout updates in SGP.32 is the shift from SMS-based triggers to lightweight, IP-based protocols. Under the previous SGP.02 standard, binary SMS messages were used to activate devices, which created challenges for Low Power Wide Area (LPWA) networks like NB-IoT and LTE-M.

"SGP.32 does not require SMS traffic to trigger the SIM card. SGP.32 uses a light profile template for download optimisation. It requires less data to send the profile to the device." – Amelie Huart, Jose Sanchez, and Eyal Yasmin, Telit Cinterion

This IP-based method significantly reduces data usage and improves battery life for devices like sensors and trackers that need to operate independently for extended periods. Additionally, it simplifies global provisioning by eliminating the need for regional SMS roaming agreements. Beyond efficiency, the protocol also bolsters security and scalability.

Improved Security and Scalability

SGP.32 leverages the existing SGP.22 (Consumer) SM-DP+ infrastructure, bypassing the need for the dedicated SM-SR/SM-DP setup required by the M2M standard. This approach enhances scalability while maintaining robust security. Enterprises can now oversee large IoT deployments from a single eSIM IoT Manager interface, avoiding the complexity of multiple platform integrations.

Looking ahead, the adoption of SGP.32 eSIMs is expected to surge, with projections estimating growth from 4.9 million units to 192.8 million by 2028. By 2030, nearly all non-consumer IoT devices are anticipated to use this standard. However, it’s important to note that SGP.32 is not backwards compatible, meaning existing device fleets using SGP.02 or SGP.22 cannot transition through software updates alone and will eventually need hardware replacement.

Technical Architecture Updates

Following earlier discussions on streamlining profile management, let’s delve into the latest updates shaping the technical architecture.

The eSIM IoT Manager (eIM)

The eSIM IoT Manager (eIM) serves as the central control system in SGP.32, transforming how businesses handle eSIM profiles across their device fleets. Unlike consumer-focused systems that often require manual input, the eIM enables remote, bulk provisioning without the need for screens or human intervention. This means fleet operators can manage tasks like downloading profiles, adjusting connectivity settings, and removing outdated profiles across thousands of devices – all from a single interface.

One of the standout features of the eIM is its independence from specific mobile network operators. This gives enterprises the flexibility to manage their connectivity strategies, whether it’s switching carriers to meet regional roaming rules or cutting costs. This capability is particularly useful for devices deployed across multiple countries. Tim Müller, Managing Director at whereverSIM GmbH, highlights:

"The eIM takes over what was previously anchored in the SM-SR, but more flexibly and without lock-in".

This centralised control system sets the stage for a more unified approach to managing both consumer and industrial IoT needs.

Hybrid Consumer IoT Approach

SGP.32 combines the simplicity of consumer solutions with the robust demands of industrial IoT. It builds on the SGP.31 architecture, leveraging the well-established SM-DP+ infrastructure from the consumer standard. By eliminating the complex SM-SR to SM-DP linking found in older M2M frameworks, this standard simplifies integration processes significantly.

A key addition in SGP.32 is the IoT Profile Assistant (IPA), which can be implemented in two ways: IPAe (embedded within the eUICC) or IPAd (deployed as software on the device). This flexibility ensures compatibility with devices that have limited resources, while still maintaining the security and functionality required for industrial use.

This streamlined integration naturally enhances support for low-power devices, a critical requirement in the IoT landscape.

Low-Power IoT Device Compatibility

SGP.32 is tailored to meet the needs of low-power, low-bandwidth devices – such as sensors, trackers, and smart meters – that dominate the massive IoT market. It employs lightweight protocols like CoAP/UDP and DTLS, which are optimised for narrowband technologies like NB-IoT and LTE-M. These protocols address the challenges of traditional SMS-based systems, which are often unavailable or unsuitable for such devices.

While profile downloads are designed to be energy-efficient, it’s still wise for enterprises to schedule these updates during periods when devices are already active for other tasks. This is especially important for devices in energy or logistics sectors, where operational lifespans can range from 10 to 20 years. The ability to remotely manage these devices over extended periods underscores SGP.32’s focus on efficiency and long-term reliability.

These updates highlight the evolution of SGP.32 as a forward-thinking standard, catering to the diverse needs of modern IoT ecosystems.

Impact on Enterprises and Global Connectivity

SGP.32’s design simplifies the management of global connectivity. By eliminating the complicated SM-SR integration that plagued earlier M2M standards, enterprises can now embrace a single SKU manufacturing model. This approach allows companies to produce one hardware version for global use, programming devices to adopt local network profiles at local rates upon deployment.

Cost Savings and Flexibility

One of the standout benefits is the financial relief from avoiding operator lock-in. With the eSIM IoT Manager (eIM) overseeing bulk profile management, enterprises gain the freedom to switch connectivity providers, unlocking competitive pricing options. In April 2025, Daniel Conradsen, TrackUnit‘s Head of Engineering, shared that they were managing over 1,500,000 eSIM connections daily across multiple countries, highlighting:

"What is very important is that our devices have to work now, tomorrow, and ten years from now, regardless of whatever challenges will emerge over the coming years".

This level of adaptability is a game-changer for sectors deploying long-lasting equipment – like construction machines, utility meters, and environmental sensors – where physical maintenance is often impractical. Additionally, the zero integration framework slashes initial deployment costs by simplifying the provisioning process. This means businesses can scale from thousands to millions of devices without a corresponding spike in operational expenses, all while maintaining strong security measures.

Better Security for Enterprise Applications

SGP.32 enhances security through encrypted, standardised SIM profile control. By separating device provisioning from SIM profile management, it reduces vulnerabilities associated with multi-platform connections and ensures secure over-the-air updates. As of April 2025, Idemia supported connectivity services for 5,000,000 devices annually. Lukasz Balczewski noted:

"The new specification has been developed as a response to the learnings of the past… Customers will be offered more choice and flexibility. OEMs will finally be able to work with more connectivity providers, limiting or eliminating the vendor blocking".

This robust security framework is especially critical for automotive use cases. By early 2025, every automotive customer partnered with Idemia was testing SGP.32 for their connected vehicle deployments.

Global Connectivity and eSIM Solutions

Beyond security and flexibility, SGP.32 enhances international connectivity. Its IP-based provisioning and support for constrained devices ensure smooth global operations. Platforms like ZIM Connections can utilise these features to provide seamless connectivity across more than 200 destinations, addressing the challenge of "silent roamers", who account for up to 90% of mobile users. The capability to remotely download local profiles also allows businesses to sidestep permanent roaming restrictions in regulated markets, ensuring uninterrupted connectivity for both travellers and IoT deployments.

Pablo Iacopino, Head of Research and Commercial at GSMA Intelligence, underscored the importance of this moment:

"2025 and beyond is what I call scale. So, the technology is available – now is the right time to scale. This will bring opportunities for the ecosystem but also for customers, consumers and enterprises".

Future of GSMA SGP.32 and eSIM Standards

Compliance and Certification Updates

As of January 2026, SGP.32 V1.2 serves as the active eSIM IoT standard, while SGP.33 V1.2 test specifications have been in place since January 2025. The certification framework aligns with SGP.24 V2.6.1 and V3.2.1, which became active in July 2025. These standards ensure that devices, eUICC components, and eSIM IoT Remote Managers (eIMs) meet GSMA’s stringent interoperability and security criteria before deployment.

A major step forward occurred in February 2025 with the release of SGP.41 V1.0, focusing on In-Factory Provisioning. This specification allows manufacturers to securely load profiles during the production phase, significantly streamlining the supply chain and cutting down on time-to-market. Additionally, the publication of Application Note AN-2025-07 in July 2025 offers vital guidelines to prevent malicious Java Card applications and misuse of eUICC profiles. These measures are designed to tackle emerging security issues as the eSIM ecosystem continues to expand.

This rigorous compliance framework is setting the stage for smoother global operations across regions.

Interoperability and Regional Customisation

The architecture of SGP.32 not only strengthens security but also simplifies global interoperability. By eliminating the complex SM-SR integrations that complicated earlier M2M standards, SGP.32 enables seamless operations across regions. A notable example came in mid-2025, when Globe Telecom in the Philippines collaborated with Thales and Bridge Alliance on a proof of concept. Spearheaded by Jon Cahilig and Dr. Ong Geok Chwee, this initiative demonstrated remote bulk SIM provisioning and profile switching among operators like Singtel (Singapore), Optus (Australia), and AIS (Thailand).

The "build-once, ship-anywhere" approach allows enterprises to localise connectivity over-the-air, avoiding roaming restrictions that typically take effect after 90 to 180 days in various countries. This capability is particularly important for meeting data sovereignty requirements under laws like the EU’s GDPR or China’s cybersecurity regulations. By enabling devices to capture, process, and store data locally through regional SIM profiles, businesses can ensure compliance. However, Scott Lemon, Senior Director for Market Engagement and Innovation at KORE, cautions:

"The standard was designed to avoid lock-in. But if your provider refuses to allow another eIM to be connected, then you’re stuck – and with that vendor forever".

To maintain long-term flexibility, enterprises must confirm that their mobile network operator (MNO) or service provider supports the addition or removal of multiple eIMs.

What’s Next for eSIM Technology

Looking ahead, eSIM technology is poised to transform global connectivity. The industry has entered what Pablo Iacopino, Head of Research and Commercial at GSMA Intelligence, refers to as the "scale" phase. With the technology now established, the focus is shifting towards mass adoption. By 2030, SGP.32 is anticipated to become the standard for nearly all non-consumer IoT devices.

Future developments include integrating eSIM management with cloud-native orchestration platforms, such as AWS, allowing businesses to handle large-scale global deployments with greater ease. Additionally, the introduction of 5G NR RedCap (Reduced Capability) is expected to play a significant role in driving SGP.32 adoption, as it supports lower-power, cost-efficient IoT devices. With IoT connections projected to hit six billion by 2030 – over half of which will depend on eSIM and remote SIM provisioning – SGP.32 is laying the groundwork for the next era of global connectivity.

Conclusion

GSMA SGP.32 is reshaping global connectivity by introducing remote SIM management and effortless profile updates. Unlike older M2M standards that required complex integrations, this new standard brings a streamlined approach with the eSIM IoT Remote Manager (eIM). This allows for remote switching of connectivity providers, centralised management of millions of devices, and over-the-air profile updates to meet regional requirements. As Pablo Iacopino, Head of Research and Commercial at GSMA Intelligence, explains:

"2025 and beyond is what I call scale. So, the technology is available – now is the right time to scale".

These advancements bring tangible benefits for enterprises and travellers alike.

For businesses, a single device model can now be deployed globally, with regional connectivity profiles loaded as needed. This not only cuts logistics costs but also simplifies operations. For instance, TrackUnit manages over 1.5 million eSIM connections daily across various countries, ensuring its devices remain functional for more than a decade, even when networks evolve. The use of IP-based provisioning ensures that SGP.32 works seamlessly with low-power IoT devices on NB-IoT and LTE-M networks.

Travellers, on the other hand, gain access to flexible and localised connectivity. With eSIM awareness doubling from 25% to 50% in just two years, and around 90% of mobile users – often known as "silent roamers" – avoiding traditional roaming, eSIM adoption is on the rise. SGP.32’s design supports multi-destination connectivity, enabling travellers to switch between local profiles without the hassle of physical SIM cards or long queues at airports.

The future looks promising, with IoT connections projected to grow from four billion to six billion by 2030, over half of which will rely on eSIM and remote provisioning. SGP.32’s focus on interoperability, security, and scalability positions it as the backbone for managing eSIMs across industrial fleets, connected vehicles, and international travel.

ZIM Connections is already paving the way with international eSIM plans covering over 200 destinations, delivering seamless global connectivity for enterprises and travellers.

FAQs

How do IP-based protocols in SGP.32 benefit IoT device management?

IP-based protocols outlined in the SGP.32 specification improve how IoT devices are managed by offering more adaptability and streamlined operations. These protocols simplify tasks such as remote provisioning and switching profiles, allowing devices to adjust smoothly to varying connectivity demands across regions.

This method ensures uninterrupted functionality throughout a device’s lifecycle, meeting the diverse needs of businesses and individuals managing IoT devices worldwide.

How does SGP.32 improve security and scalability for managing large IoT networks?

SGP.32 strengthens security by requiring the use of encrypted, lightweight protocols such as DTLS over CoAP/UDP for downloading eSIM profiles. Additionally, it embeds advanced security mechanisms directly into the eUICC architecture, ensuring that communication remains protected and sensitive data is safeguarded during remote provisioning.

On the scalability front, SGP.32 introduces a standardised framework for remote SIM provisioning. This shifts the responsibility for profile management from network operators to device manufacturers. As a result, it simplifies over-the-air (OTA) profile switching, ensures interoperability across various regions, and makes managing extensive IoT networks much more efficient.

Why isn’t SGP.32 compatible with older eSIM standards like SGP.02?

The SGP.32 standard brings a fresh approach to eSIM management by introducing an entirely new architecture. Unlike the older SMS-driven and ASN.1-based frameworks of SGP.02, this updated standard incorporates modern interfaces and data models designed for streamlined operations. However, these differences mean that SGP.32 and SGP.02 are not compatible with each other.

This shift highlights the GSMA’s commitment to enhancing efficiency and scalability in eSIM solutions, ensuring they meet the demands of today’s rapidly evolving connectivity landscape.