One of the more revealing eSIM announcements of 2026 looked, at first, like a cloud story. In February, Giesecke+Devrient said it would transition eSIM workloads to Amazon Web Services and make its technology available through AWS Marketplace. A month later, Tele2 IoT, IDEMIA Secure Transactions and Cisco launched an SGP.32-based IoT offer designed to let enterprises manage global connectivity without making their own complex eIM or SM-DP+ decisions.

Put the two announcements together and a larger shift appears. SM-DP+ is not disappearing from the eSIM stack. It is becoming infrastructure that increasingly works best when the customer barely has to think about it.

That creates an uncomfortable commercial question for vendors that once treated ownership of an SM-DP+ as a headline differentiator. If secure profile provisioning becomes easier to consume as a managed, cloud-delivered or bundled capability, where does differentiation go next?

The answer is already visible: upwards.

The boring layer that absolutely cannot fail

SM-DP+ deserves more respect than the word “commodity” usually implies. In the GSMA consumer architecture, the Subscription Manager Data Preparation Plus prepares and securely delivers operator profiles to the eUICC. It is part of the trust chain that allows a mobile subscription to move from an operator’s systems into a secure element on a device.

That job remains highly sensitive. GSMA compliance rules require SM-DP+ implementations and their hosting sites to meet applicable certification requirements, including SAS-SM. Security, cryptographic handling, interoperability, availability and operational discipline are not optional extras.

The standards are still moving. GSMA lists SGP.22 v2.7, published in April 2026, for consumer eSIM and SGP.32 v1.3, published in May 2026, for IoT as active specifications. SGP.32 does not remove SM-DP+. It reuses it while adding the IoT Profile Assistant, or IPA, and the eSIM IoT Manager, or eIM, to make remote lifecycle management practical for constrained devices and large fleets.

So the sensible commoditisation argument is almost the opposite of “SM-DP+ no longer matters.” SM-DP+ is becoming established enough that buyers can increasingly treat secure provisioning as a dependable platform capability rather than the whole proposition.

Telecom has seen this before. Cloud compute and payment rails are essential, but their value increasingly comes from what businesses build on top of them. Once an underlying function becomes reliable, standardised and widely available, more of the competitive battle moves to decisions, workflows and customer relationships.

Cloud delivery changes the procurement conversation

G+D’s AWS move is important for exactly this reason. The company says its new approach will support SGP.22 and SGP.32 workloads across multiple geographies, combine GSMA compliance with AWS infrastructure, and allow customers to source G+D technology through AWS Marketplace. G+D is also deploying SGP.32 technology for Amazon’s eero Signal device.

For an operator or IoT provider, that changes the buying conversation. The question becomes less “Can somebody build us an SM-DP+?” and more “How quickly can we deploy, where can we host, how does it scale, and what else can the platform automate?”

Trasna offers another signal. After acquiring Workz in 2024, it continued expanding from eSIM servers into broader lifecycle and IoT services. In February 2026, Trasna and Kigen announced an expanded managed eSIM service using geo-redundant server environments in Dublin and Dubai, 24/7 support and automation. The package is broader than provisioning because customers increasingly want the operational headache removed too.

None of this means every SM-DP+ is interchangeable. Hosting jurisdiction, resilience, migration, incident response and supplier maturity still matter, especially for operators, automotive manufacturers and utilities deploying at scale.

Cloudification makes the infrastructure easier to consume. It does not make poor infrastructure acceptable.

SGP.32 shows where the control layer is heading

The shift becomes even clearer in IoT.

Under SGP.32, the eIM can remotely trigger and coordinate profile operations for IoT devices, while the IPA handles profile-related functions on the device or eUICC side. Kigen describes its eIM as able to consolidate connections to multiple SM-DP+ platforms, reducing backend integration complexity.

That architectural separation matters commercially.

If a business has vehicles, meters or trackers spread across 20 countries, it rarely cares which server prepared profile number 842,391. It cares whether the right profile reaches the right device under the right commercial and regulatory conditions, without sending somebody to a warehouse with a screwdriver.

That requires policy. When should a profile be downloaded or enabled? What happens if a device enters a market with permanent-roaming restrictions? How is a failed profile operation detected and retried? How does the business reconcile usage across several connectivity suppliers?

SM-DP+ participates in that system. It does not answer those questions by itself.

This is why “orchestration” has rapidly become one of the eSIM industry’s favourite words — occasionally with more enthusiasm than precision. Thales and Simetric announced an SGP.32 proposition in February combining Thales provisioning with Simetric’s cross-platform management and orchestration. Tele2’s offer similarly combines IDEMIA’s eSIM infrastructure, Cisco’s Mobility Services Platform and Tele2 connectivity.

The pattern is difficult to miss: secure provisioning is being packaged inside a broader operating layer for connectivity.

Consumer eSIM has its own value layer

The same commercial logic applies to smartphones, even though the architecture and user journey are different.

A traveller buying an eSIM for Japan does not know which SM-DP+ prepared the profile. Nor should they. They notice whether installation works, whether activation is straightforward, and whether service can be recovered after a phone replacement or deleted profile.

That is where entitlement and lifecycle experience become strategic.

G+D’s AirOn360 Entitlement Server, for example, works with SGP.22 eSIM platforms and supports functions including eSIM transfer, Apple eSIM Quick Transfer, Android Device Transfer, VoLTE, Wi-Fi Calling and wearable activation. The distinction matters: the SM-DP+ supplies the profile; the entitlement layer helps authorise and coordinate device-native services and transfer journeys around it.

Counterpoint Research’s market taxonomy is another clue. Its 2026 work evaluates eSIM orchestration separately from provisioning and enablement. In its May consumer orchestration ranking, Amdocs and Valid were placed in the top pacesetter group. Whatever one thinks of individual rankings, the category itself tells us something: orchestration is now considered a distinct competitive capability.

For travel eSIM providers, this should be a warning against infrastructure theatre. Owning more of the stack can improve control, economics and troubleshooting. But “we have our own SM-DP+” does not compensate for poor network selection, confusing installation, weak recovery, opaque fair-use policies or support that arrives after the traveller has flown home.

Infrastructure credibility matters most when it improves the customer experience, not when it becomes a badge on a sales deck.

Where the commercial leverage moves

There is no public dataset proving that orchestration margins are universally higher than SM-DP+ margins, and vendor contracts are too private to make that claim responsibly.

The stronger conclusion is about leverage.

The policy layer can influence which profile is used and when. Entitlement can improve device-native activation and transfer. Orchestration can coordinate suppliers, events and lifecycle rules. Connectivity providers manage operator relationships and regulatory constraints. Distributors may own the traveller, enterprise or embedded-product customer.

Those layers create more opportunities to influence revenue, retention, support cost and switching behaviour than secure profile preparation alone.

They can also create new lock-in. A buyer may avoid dependency on one SM-DP+ provider, then discover that billing logic, analytics, workflows, policy rules and support tools are inseparable from a single orchestration platform. Commoditising one layer does not eliminate lock-in; sometimes it simply moves it upstairs.

That is why buyers should ask about multi-SM-DP+ support, profile portability, APIs, event access, migration procedures and data export before becoming impressed by a beautifully unified dashboard.

The best infrastructure may be the infrastructure nobody talks about

SM-DP+ is entering a more mature phase. The standards remain demanding, the security burden remains high and reliable execution still separates credible infrastructure from PowerPoint infrastructure. For high-scale IoT, automotive, utilities and operator deployments, that distinction is anything but trivial.

But 2026 is making the direction clearer. G+D is taking provisioning workloads deeper into the cloud. Tele2, IDEMIA and Cisco are selling an end-to-end SGP.32 outcome in which customers can avoid making individual infrastructure decisions. Kigen is positioning eIM as a way to coordinate across SM-DP+ environments. Entitlement platforms compete on what happens before, after and around the profile download.

The value of SM-DP+ is therefore not collapsing. Its visibility is.

And that may be the real sign of success. Mature infrastructure becomes something customers trust enough to stop admiring. The next margin battle will be fought by the companies that decide what the infrastructure does, how intelligently it does it, how easily customers can switch, recover and scale — and who owns the relationship when something goes wrong.