Microsoft Intune Guide: Deploying Corporate eSIMs

Microsoft Intune allows IT administrators to deploy eSIM profiles by creating a cellular configuration profile using the carrier's SM-DP+ address and matching ID. This process enables zero-touch provisioning of data plans to managed Windows, iOS, and Android devices, ensuring global teams remain connected without physical SIM cards. By leveraging the Microsoft Endpoint Manager, organizations can automate the distribution of high-speed data across a global fleet.

The Evolution of Corporate Connectivity

For the modern IT manager, the days of mailing physical SIM cards to a consultant landing in London or a sales executive heading to Tokyo are over. Physical SIMs represent a logistical bottleneck and a security risk. If a device is lost, a physical SIM can be easily removed and used in an unauthorized device. Conversely, an eSIM deployed via Microsoft Intune is cryptographically tied to the device's EID (Embedded Identity Document), offering a hardware-level layer of security that is essential for modern enterprise compliance.

As business travel resumes its pace, the demand for reliable, high-speed data for Zoom calls and VPN stability has never been higher. Relying on unsecured hotel Wi-Fi is no longer an option for security-conscious firms. Deploying a dedicated travel eSIM ensures that employees have a secure, private tunnel to corporate resources the moment they touch down. Before starting a mass deployment, it is critical to check if your fleet is on the device compatibility list to ensure the hardware supports the GSMA standards required by Intune.

Prerequisites for Intune eSIM Deployment

To successfully push cellular profiles to your team, you must meet several technical requirements. This is not a one-size-fits-all process; it requires coordination between your mobile device management (MDM) strategy and your carrier's infrastructure.

• Device Eligibility: For Windows, you generally need Windows 10 version 1709 or later with an LTE-capable modem. For iOS, iPhone XS or later is required. Android Enterprise support varies but is robust on newer Samsung Galaxy and Google Pixel devices.
• Intune Licenses: Your organization must have active Microsoft Intune or Microsoft 365 E3/E5 licenses.
• SM-DP+ Address: You need the Subscription Manager Data Preparation (SM-DP+) address from your provider. This is the server URL that the device contacts to download the eSIM profile.
• Carrier Activation Codes: These are often provided in a CSV format for bulk uploads, containing the EIDs of the devices and the corresponding activation codes.

Understanding the SM-DP+ Infrastructure

The SM-DP+ server is the heart of the eSIM ecosystem. When you configure a profile in Intune, you are essentially telling the device where to look for its digital identity. For global deployments, RoamExec provides the necessary technical parameters to ensure that your team can transition from the United States to Europe without manual intervention.

When a device receives the Intune policy, it reaches out to the SM-DP+ server. If the device's EID matches a record on the server, the download begins. This process is seamless for the user, often occurring in the background while they are still in the taxi from the airport. It is also a best practice to consider setting up a fallback secondary travel eSIM for high-stakes consultants who cannot afford a single minute of downtime during multi-city meetings.

Step-by-Step: Deploying to Windows 10/11 Devices

Windows devices offer the most granular control for eSIM management. Using the "Cellular" configuration profile, you can automate the entire lifecycle of the data plan.

1. Create the Profile: In the Microsoft Endpoint Manager admin center, navigate to Devices > Configuration profiles > Create profile.
2. Select Platform: Choose Windows 10 and later and select Templates > Cellular.
3. Configure Settings: You will be prompted to upload a CSV file. This file must contain the EID of the target devices and the Activation Code provided by your carrier.
4. Assignment: Assign the profile to a specific Azure AD (Entra ID) group. We recommend testing with a small pilot group of frequent flyers before a global rollout.

During this process, the "Mobile Plans" app on Windows may be utilized. It is important to note that these are "data only" plans and do not provide a local phone number. This is ideal for consultants who rely on VoIP services like Teams, Slack, or Zoom for communication.

Deploying to iOS and iPadOS

Apple devices are a staple for business professionals in New York City Hubs and other financial centers. Deployment here focuses on the "Cellular" workload within the iOS configuration profile.

The Activation Process

For iOS, you can use the eSIM Carrier Activation feature. This allows the carrier to push the profile directly to the device based on its IMEI. In the Intune portal, you create a profile that specifies the carrier's URL. When the user completes the Out-of-Box Experience (OOBE) or simply checks for updates, the device prompts them to install the cellular plan. This eliminates the need for QR codes, which are often difficult to manage at scale.

Comparison: Physical SIM vs. Intune eSIM Deployment

Feature	Physical SIM	Intune eSIM Deployment
Logistics	Physical shipping required	Remote Over-the-Air (OTA)
Security	Removable, high theft risk	Hardware-bound, secure
User Experience	Manual insertion/tool needed	Zero-touch or one-tap activation
Scalability	Linear effort per device	Bulk deployment via CSV/API
Management	Difficult to track usage	Centralized MDM reporting

Security Realities: Why eSIM Wins for Business Travel

When your team travels to high-traffic zones like the London Financial District or Singapore's CBD, they are surrounded by hundreds of "Free Wi-Fi" hotspots. These are prime targets for man-in-the-middle (MITM) attacks. By deploying corporate eSIMs via Intune, you ensure that employees have a high-speed cellular connection that is encrypted by the mobile network's own standards.

RoamExec plans are designed with this security-first mindset. By providing reliable data that bypasses public infrastructure, you protect sensitive company data and VPN credentials. Furthermore, because these profiles can be managed remotely, if an employee leaves the company or a device is compromised, the IT manager can instantly revoke the eSIM profile via the Intune console.

Troubleshooting Common Deployment Issues

Even with a robust MDM like Intune, deployment can hit snags. The most common error is a mismatch between the EID and the activation record on the SM-DP+ server. Always double-check your CSV formatting.

Another issue is "No Service" upon arrival. This often happens if the device has not yet performed a check-in with Intune to receive the cellular policy. Encourage your users to sync their devices before leaving the office or while still on a known-good Wi-Fi connection at the airport. You can direct them to a guide on how to activate your profile if they need manual steps, though the goal of Intune is to minimize this.

Managing Global Teams with RoamExec

RoamExec is built for the enterprise. We understand that IT managers need more than just data; they need expense-ready receipts and the ability to purchase in bulk for entire teams. Whether your consultants are hopping between NYC, London, and Tokyo, our platform provides seamless switching between the world's best carriers, such as EE in the UK or NTT Docomo in Japan.

Our data-only plans ensure that your team stays focused on their work without the distraction of managing local SIM cards or worrying about roaming overages from home carriers, which can be astronomical. By integrating RoamExec eSIMs into your Microsoft Intune workflow, you achieve a level of operational efficiency that physical SIMs simply cannot match.

The bottom line

Deploying corporate eSIMs via Microsoft Intune is the gold standard for modern fleet management. It combines the security of hardware-bound identities with the agility of cloud-based deployment. By following this guide and utilizing a professional partner like RoamExec, IT managers can ensure their global teams remain connected, secure, and productive, regardless of which continent their next meeting is on.