MDM eSIM Deployment: Jamf, Intune & Knox Guide

Why eSIM Management Has Become a Corporate IT Priority

Managing cellular connectivity for a distributed workforce used to mean ordering SIM cards by the box, shipping them to employees, and hoping nothing got lost. eSIM changes that equation entirely — but it introduces a new layer of complexity that IT administrators need to navigate carefully.

According to the GSMA, over 2 billion eSIM-capable devices were in active use globally by the end of 2025, and enterprise adoption is accelerating as device manufacturers phase out physical SIM trays entirely. Apple's iPhone 16 lineup, for example, ships without a physical SIM slot in the United States — a clear signal of where the industry is headed.

For IT teams managing fleets of 50, 500, or 5,000 devices, the ability to push a cellular plan remotely — without touching a single handset — is transformative. It cuts provisioning time from days to minutes, reduces SIM inventory costs, and enables instant connectivity for employees the moment they land in a new country. Whether your team is traveling to Japan, Germany, or Australia, the right MDM-eSIM integration means they're online before they clear customs.

This guide breaks down the deployment patterns for the three dominant MDM platforms — Jamf, Microsoft Intune, and Samsung Knox — with practical configuration guidance, a comparison of capabilities, and the edge cases that trip up even experienced admins.

What Does "eSIM at Scale" Actually Mean?

Deploying eSIM at scale means provisioning, managing, and revoking cellular data plans across a device fleet entirely over the air, without physical SIM logistics. A fully mature deployment lets an admin assign a local data plan to an employee's phone in Singapore from a dashboard in Chicago — in under two minutes.

At its core, enterprise eSIM management relies on three building blocks:

eUICC (Embedded Universal Integrated Circuit Card): The hardware chip inside the device that stores multiple operator profiles.
LPA (Local Profile Assistant): The software layer on the device that communicates with the SM-DP+ server to download and activate profiles.
SM-DP+ (Subscription Manager Data Preparation+): The carrier-side server that packages and delivers eSIM profiles securely.

MDM platforms sit on top of this stack, using vendor-specific APIs and Apple/Google/Samsung management frameworks to orchestrate profile delivery without requiring user interaction. The degree of automation — and the limitations — vary significantly between Jamf, Intune, and Knox.

How Does Jamf Handle eSIM Deployment for Apple Devices?

Jamf is the gold standard for managing Apple device fleets, and its eSIM support reflects that depth. For organizations running iOS 16+ and macOS 13+ devices, Jamf Pro and Jamf School both support cellular plan management through Apple's Device Enrollment Program (DEP) and the MDM eSIM payload.

The core workflow looks like this:

Devices are enrolled in Apple Business Manager (ABM) and assigned to a Jamf MDM server.
The IT admin configures an eSIM payload in Jamf Pro, specifying the carrier's SM-DP+ activation code or using a carrier-provided API integration.
The payload is scoped to a device group (e.g., "APAC Sales Team") and deployed.
Devices silently download and activate the eSIM profile — no user interaction required on supervised devices.

Supervised vs. Unsupervised Devices

This distinction matters enormously. On supervised iOS devices (the standard for corporate fleets enrolled via ABM), eSIM profiles can be pushed silently and users cannot delete them without IT permission. On unsupervised devices (BYOD), the user must manually accept the profile, and MDM control over the eSIM is significantly limited.

Jamf's eSIM Payload Configuration

The com.apple.cellularprivatenetwork.managed payload (introduced in iOS 16) is the key configuration profile for managed eSIM. Key fields include:

EID — the device's eSIM identifier, used to target specific hardware
MatchingEID — allows profile targeting by EID range for bulk deployments
ServiceProviderName — the carrier name displayed to the user
ActivationCode — the SM-DP+ URI from your carrier partner

For multi-country deployments, Jamf admins typically create separate payload configurations per region and use Smart Groups to automatically scope the right plan to devices based on location data or user group membership.

What Jamf Can't Do (Yet)

Jamf cannot currently trigger real-time eSIM switching based on GPS location or network signal strength — that logic must be handled either by the carrier's own app or by a custom automation. Admins working around this limitation often use iOS Shortcuts and automation routines to prompt users to switch profiles when they enter a new region.

How Does Microsoft Intune Deploy eSIMs Across Mixed Fleets?

Microsoft Intune supports eSIM provisioning for both iOS/iPadOS and Android Enterprise devices, making it the go-to platform for organizations running heterogeneous device fleets. As of 2026, Intune's eSIM capabilities have matured significantly, though they remain somewhat more complex to configure than Jamf's Apple-native approach.

Intune's eSIM management is delivered through two primary mechanisms:

Device Configuration Profiles — for iOS devices, Intune leverages the same Apple MDM eSIM payload as Jamf, configured through the Intune admin center.
Android Enterprise Work Profile / Fully Managed — for Android devices, Intune uses Android's Telephony Management APIs to deliver eSIM profiles to devices enrolled in Android Enterprise.

iOS eSIM via Intune

The process mirrors Jamf closely: devices must be enrolled via Apple Business Manager, supervised, and assigned a configuration profile containing the carrier's activation code. The admin experience in Intune's portal is slightly less granular than Jamf Pro, but for most enterprise use cases, the outcome is identical.

One advantage Intune has over Jamf in mixed environments: conditional access policies can be tied to cellular plan status. An admin can require that a device have an active managed eSIM profile before it's granted access to corporate resources — a powerful zero-trust enforcement mechanism.

Android Enterprise eSIM via Intune

This is where things get more nuanced. Android's eSIM management API (available since Android 10, significantly improved in Android 13+) allows MDMs to add, switch, and delete eSIM profiles on fully managed devices. However, the implementation quality varies by device manufacturer — a Samsung Galaxy device behaves differently from a Google Pixel, even running the same Android version.

For Android Enterprise Fully Managed (COBO) devices, Intune can:

Push eSIM activation codes via the EuiccManager API
Lock the active eSIM profile so users cannot switch plans
Wipe eSIM profiles as part of a device retirement or reset workflow

For Work Profile (BYOD) devices, eSIM management is restricted to the work profile container — corporate eSIM profiles are isolated from personal ones, but the admin's control is more limited.

Intune's eSIM Reporting Gap

One area where Intune lags behind Jamf is eSIM status reporting. As of mid-2026, Intune's built-in reporting doesn't surface eSIM profile status (active/inactive/failed) in a unified dashboard view. Admins typically work around this by querying the Microsoft Graph API (/deviceManagement/managedDevices) and filtering on phoneNumber and subscriberCarrier fields — not ideal, but functional.

How Does Samsung Knox Manage eSIM on Android Fleets?

Samsung Knox is Samsung's enterprise security and management platform, and it provides the deepest eSIM management capabilities available on Android devices. For organizations standardized on Samsung hardware — common in industries like logistics, field services, and healthcare — Knox offers capabilities that generic Android Enterprise management simply can't match.

Knox's eSIM management is built on three layers:

Knox Platform for Enterprise (KPE) — the low-level device API that enables eSIM provisioning, locking, and auditing at the hardware level.
Knox Manage — Samsung's own MDM solution, which exposes KPE capabilities through a web console.
Knox APIs for third-party MDMs — Intune, VMware Workspace ONE, and other MDMs can access Knox eSIM APIs through Samsung's Knox SDK.

Knox eSIM Deployment Workflow

For Samsung devices enrolled in Knox Mobile Enrollment (KME), the eSIM deployment workflow is highly automated:

Devices are pre-registered in KME using IMEI or serial numbers.
An eSIM configuration policy is created in Knox Manage (or the third-party MDM via Knox SDK).
On first boot, the device automatically enrolls and downloads the assigned eSIM profile — zero-touch provisioning.
Knox's eSIM Lock feature prevents users from adding, deleting, or switching eSIM profiles without IT authorization.

Knox-Specific Capabilities Worth Knowing

Dual eSIM management: Samsung's flagship devices support dual eSIM (two simultaneous eSIM profiles). Knox can manage both slots independently, enabling scenarios like "corporate data on eSIM 1, personal data on eSIM 2."
eSIM audit logs: Knox logs every eSIM profile add/remove/switch event with timestamp and user context — invaluable for compliance in regulated industries.
Geofencing triggers: Knox's location-aware policies can automatically switch the active eSIM profile when a device enters a defined geographic region, something neither Jamf nor Intune supports natively.

For teams deploying devices across Southeast Asia or the Middle East and North Africa, Knox's geofencing-based profile switching is particularly valuable — it ensures employees are always on the most cost-effective local plan without any manual intervention.

Jamf vs. Intune vs. Knox: Side-by-Side Comparison

Choosing the right MDM platform for eSIM deployment isn't just about features — it's about matching the platform to your device mix, IT maturity, and operational requirements. Here's how the three platforms stack up across the dimensions that matter most for enterprise eSIM management.

Capability	Jamf Pro	Microsoft Intune	Samsung Knox
Primary OS support	iOS/macOS	iOS, Android, Windows	Android (Samsung only)
Silent eSIM push (supervised)	✅ Yes	✅ Yes (iOS); ✅ Android Enterprise	✅ Yes (KME enrolled)
BYOD eSIM control	⚠️ Limited	⚠️ Limited (Work Profile)	⚠️ Limited
Dual eSIM management	⚠️ Single profile only	⚠️ Limited	✅ Full dual-slot control
Geofencing profile switch	❌ Not native	❌ Not native	✅ Native
eSIM audit logging	⚠️ Basic MDM logs	⚠️ Graph API query needed	✅ Dedicated audit trail
Zero-touch provisioning	✅ Via ABM/DEP	✅ Via ABM/Android Zero-Touch	✅ Via KME
Conditional access on eSIM status	❌ Not native	✅ Via Conditional Access policies	✅ Via Knox policies
Third-party MDM integration	N/A (is the MDM)	Native Microsoft ecosystem	Knox SDK for third-party MDMs
eSIM profile locking	✅ Supervised iOS	✅ COBO Android	✅ Hardware-level lock

What Are the Common Pitfalls in Enterprise eSIM Deployments?

Even well-planned eSIM rollouts hit snags. Understanding the failure modes before you start saves weeks of troubleshooting. The most common issues fall into four categories: carrier compatibility, device eligibility, profile conflicts, and user experience gaps.

Carrier API Compatibility

Not every carrier that sells eSIM plans has an MDM-compatible SM-DP+ server. Some carriers require users to scan a QR code manually — which defeats the purpose of MDM automation. Before committing to a carrier for your fleet, verify explicitly whether they support:

GSMA SGP.22 (Consumer eSIM) — the standard most devices use
GSMA SGP.02 (M2M eSIM) — used for IoT and some enterprise deployments
MDM API integration — direct API access to their SM-DP+ for automated provisioning

Carriers that don't support direct MDM API integration can still work in an enterprise context, but you'll need to build a middle layer — typically a script that generates activation codes and injects them into MDM payloads via the platform's API.

Device Eligibility Checks

eSIM support varies not just by device model, but by carrier lock status, firmware version, and regional hardware variant. A device purchased in one country may have eSIM functionality restricted by the original carrier even after it's been unlocked for international use. The GSMA's eSIM device compatibility list is the authoritative reference — check it before purchasing fleet hardware.

Key checks before deployment:

Confirm the device has an eUICC chip (not all budget Android devices do)
Verify the device is carrier-unlocked
Check that the firmware version supports your MDM's minimum OS requirement
For Samsung devices, confirm Knox version compatibility with your KPE API calls

Profile Conflicts and the "Too Many Profiles" Problem

iOS devices support up to 8 eSIM profiles stored on the device, with 2 active simultaneously (on dual-SIM capable models). Android support varies by manufacturer. When MDM pushes a new profile to a device that's already at capacity, the push fails silently on some platforms — the admin sees a "delivered" status in the MDM console, but the device never activates the plan.

Best practice: implement a profile cleanup policy that removes inactive eSIM profiles older than 30 days as part of your device management lifecycle.

APN Configuration Alongside eSIM Profiles

eSIM provisioning and APN configuration are separate concerns that need to work in tandem. A device can successfully download an eSIM profile but fail to route data correctly if the APN settings aren't configured. For a detailed walkthrough of finding, editing, and verifying APN settings across iOS and Android, see our eSIM APN settings guide — the troubleshooting steps there apply equally to MDM-deployed profiles.

How Should You Structure a Phased eSIM Rollout?

A phased rollout reduces risk and gives your IT team time to identify issues before they affect the entire fleet. A well-structured enterprise eSIM deployment typically follows four phases, regardless of which MDM platform you're using.

Phase 1 — Pilot (Weeks 1–3) Select 10–20 devices across different hardware models, OS versions, and geographic locations. Deploy eSIM profiles manually (via QR code or activation code) to validate carrier compatibility and device eligibility. Document every failure and its root cause.

Phase 2 — MDM Integration Testing (Weeks 4–6) Configure your MDM platform's eSIM payload using the pilot carrier. Push profiles to the pilot group via MDM and compare the success rate against manual provisioning. Identify any devices where MDM push fails and investigate whether it's a device, carrier, or MDM configuration issue.

Phase 3 — Limited Production Rollout (Weeks 7–10) Expand to 10% of the fleet, prioritizing high-travel employees first. Monitor eSIM activation success rates, data usage, and support ticket volume. Establish your baseline metrics for what "normal" looks like.

Phase 4 — Full Fleet Deployment (Weeks 11+) Roll out to the remaining fleet in batches, using Smart Groups (Jamf), dynamic device groups (Intune), or KME policies (Knox) to automate assignment. Maintain a rollback procedure — the ability to push a "delete eSIM profile" command — in case of widespread issues.

What Security Considerations Apply to MDM-Managed eSIMs?

eSIM profiles managed through MDM introduce security considerations that don't exist with physical SIM cards. Because profiles are software-defined and can be pushed remotely, they're also a potential attack surface if your MDM environment isn't properly secured.

Key security controls for enterprise eSIM deployments:

MDM server access control: Restrict eSIM payload configuration to senior IT admins. A misconfigured push to the wrong device group can disrupt connectivity for hundreds of users simultaneously.
SM-DP+ server authentication: Ensure your carrier's SM-DP+ server uses mutual TLS authentication. The GSMA's SGP.22 specification requires this, but verify it's actually enforced in your carrier contract.
Profile signing: All eSIM profiles must be cryptographically signed. Verify that your MDM platform validates profile signatures before installation — this prevents profile spoofing attacks.
Remote wipe includes eSIM: Confirm that your MDM's remote wipe command includes eSIM profile deletion. Leaving an active corporate eSIM on a lost or stolen device is a data exposure risk, even if the device itself is encrypted.
Audit trail requirements: For organizations subject to compliance frameworks (SOC 2, ISO 27001, HIPAA), Knox's dedicated eSIM audit logs are a significant advantage over the more limited logging in Jamf and Intune.

According to NIST's mobile device security guidelines (SP 800-124r2), enterprise mobile device management should include controls for all communication interfaces — eSIM profiles are explicitly included in this scope as of the 2023 revision.

FAQ

Can I manage eSIM profiles on BYOD devices through MDM?

BYOD eSIM management is significantly limited across all three platforms. On iOS, unsupervised (BYOD) devices require user consent to install MDM-pushed eSIM profiles and users can delete them at any time. On Android Work Profile, corporate eSIM profiles are containerized but the user retains control over personal eSIM slots. For true enterprise-grade eSIM control, corporate-owned supervised/fully managed devices are strongly recommended.

Does Jamf support eSIM management on macOS as well as iOS?

Jamf Pro supports eSIM management on both iOS/iPadOS 16+ and macOS 13+ devices with cellular capability (e.g., Apple Silicon MacBook Pro and MacBook Air models with optional cellular). The configuration payload is the same across both platforms, though macOS cellular-capable devices are less common in most enterprise fleets. Check Apple's device compatibility list to confirm which Mac models support eSIM in your region.

What happens to an eSIM profile when a device is wiped or reset?

When an MDM-initiated factory reset or remote wipe is performed, eSIM profiles are deleted from the device's eUICC. However, the profile record on the carrier's SM-DP+ server is not automatically deleted — the carrier retains the profile and it can be re-pushed to the same or a replacement device. This means a wiped device can have its eSIM plan re-provisioned instantly via MDM without contacting the carrier, which is a significant operational advantage over physical SIM logistics.

How do I handle eSIM provisioning for employees traveling internationally?

The most common approach is to maintain a library of regional eSIM profiles in your MDM — for example, one plan for North America, one for Europe, one for Asia — and use Smart Groups or dynamic groups to push the appropriate profile based on the employee's travel itinerary or home region. Some organizations integrate their travel booking system with MDM APIs to trigger automatic profile assignments when a business trip is approved. For individual travelers, a travel eSIM from a provider like Simology offers flexible regional plans that can be activated without IT involvement.

Can eSIM profiles be transferred between devices through MDM?

eSIM profiles cannot be directly transferred between devices — each profile is cryptographically bound to the target device's EID at the time of provisioning. To move a plan from one device to another, the admin must delete the profile from the original device (which returns it to the carrier's SM-DP+ server as available) and then push a new activation to the replacement device. This process takes minutes via MDM, compared to hours with physical SIM logistics.

Which MDM platform is best for a fleet that mixes iPhones and Samsung Android devices?

Microsoft Intune is the most practical choice for mixed iOS/Android fleets, as it provides a unified management console for both platforms. However, for the deepest eSIM capabilities on Samsung devices, pairing Intune with Samsung Knox APIs (via the Knox SDK integration) gives you the best of both worlds — Intune's cross-platform dashboard with Knox's hardware-level eSIM controls on Samsung hardware. Pure Apple fleets are better served by Jamf, which offers more granular iOS/macOS eSIM configuration options.

What is the minimum iOS/Android version required for MDM eSIM management?

For iOS, MDM-managed eSIM provisioning requires iOS 16 or later (the com.apple.cellularprivatenetwork.managed payload was introduced in iOS 16). For Android Enterprise, the EuiccManager API used for MDM eSIM management requires Android 10 or later, with significantly improved reliability on Android 13+. Samsung Knox eSIM management via KPE requires Knox version 3.0 or later. Devices running older OS versions will need to be updated or replaced before they can participate in an MDM-managed eSIM deployment.

How does eSIM profile management interact with carrier billing?

eSIM profile provisioning via MDM doesn't automatically handle carrier billing — the commercial relationship between your organization and the carrier is separate from the technical provisioning workflow. Most enterprise carriers offer centralized billing portals where all eSIM activations (regardless of whether they were pushed via MDM or manually) appear under a single account. Some carriers offer MDM-integrated billing APIs that let admins view data usage per device directly in the MDM console, but this is a premium feature and availability varies by carrier and region.

MDM + eSIM at Scale: Jamf, Intune, and Knox Deployment Patterns