What is an M2M SIM card? How M2M and IoT SIMs differ from phone SIMs

What is an M2M SIM card?

An M2M SIM card is a SIM sold and built for machines rather than people. The name expands to machine-to-machine subscriber identity module. The SIM, or subscriber identity module, is the chip that lets a device prove to a mobile network that it has a subscription, and M2M says who is using it. The chip works the same way as the one in a phone. What changes is everything around it: the plan carries data and little else, the SIM can usually reach more than one network, the whole fleet is managed from one platform, and the hardware is built to survive years in a meter cupboard or an engine bay.

M2M stands for machine-to-machine: devices that send data to a server, or to each other, with nobody operating them. A smart meter sending readings, a vehicle tracker reporting its position, an alarm panel raising an alert and a remote sensor logging a tank level are all M2M devices. When the link is a mobile network, the device needs a SIM, and that is the M2M SIM.

IoT SIM vs M2M SIM

In most offers they are the same product under two names. M2M is the older term, from when cellular links in machines were mostly point-to-point telemetry: a meter or a tracker reporting to its own server. IoT, the internet of things, became the wider name for connected devices, and SIM providers now mostly sell the same SIMs as IoT SIMs. The GSMA’s eSIM specifications show the shift: its first remote provisioning specification for machines, SGP.02, is known as the M2M specification, and its newer one, SGP.32, is titled eSIM IoT.

Some providers use “IoT SIM” for their newer products, with eSIM profiles or NB-IoT and LTE-M support, and keep “M2M SIM” for older ones. Others use the two names for the same thing. When comparing offers, look at the plan, the networks, the management platform and the hardware grade rather than the name on the pack.

M2M SIM vs regular SIM at a glance

What makes an M2M or IoT SIM different from a phone SIM

Underneath, both are UICCs, smart cards running the SIM application that holds the subscriber identity and the secret key the network checks. A device with a phone SIM in it will often connect perfectly well. The differences show up when there are hundreds or thousands of devices and they need to run unattended for years.

Data-only plans

Most IoT devices never make a call. Their plans are data-only, sometimes with SMS kept for waking a device or sending it configuration. Data is usually shared across the fleet, so a device that sends more one month is balanced by devices that send less, and each SIM can have its own usage cap and alerts.

More than one network

A phone SIM belongs to one operator and roams when it travels. An IoT SIM is often designed from the start to use several networks. There are three common ways to do that. A roaming SIM uses one home operator’s profile and roams onto partner networks in many countries. A multi-IMSI SIM carries several subscriber identities and switches between them, changing which networks it looks like it belongs to. An eSIM can download a whole new operator profile, which is covered below. Multi-network access matters for coverage, because a device fixed in a basement cannot move to find a better signal, and for resilience when one network has an outage. It also matters because some countries and operators restrict permanent roaming, so a device installed abroad for good may eventually need a local profile.

Fleet management

IoT SIMs are managed through a connectivity management platform run by the provider. From it you can activate and suspend SIMs, see usage and network attach history per SIM, set limits and alerts, send SMS to devices, and run basic diagnostics, usually through an API as well as a web interface. Every SIM in it is listed by its ICCID, the card’s serial number; the ICCID explainer goes through that number and how it relates to the IMSI and IMEI.

Activation

A phone SIM is activated once, by the person who buys it. M2M SIMs arrive in batches and are activated as devices go into service. Depending on the provider, a SIM may ship in a test or inventory state with a small allowance so the device can be checked on the production line, then move to active either automatically on its first network connection or when someone activates it in the platform or through the API. Suspending a SIM stops it working without cancelling it, which is how a device in storage or a stolen unit is handled. Ask a provider which states its SIMs pass through and when billing starts, because that decides what a device sitting in a warehouse costs.

Industrial grades

Consumer SIMs are built for the inside of a phone in a pocket. ETSI’s specification for SIMs in machines, TS 102 671 (version 19.0.0, May 2026), defines classes a SIM maker can claim for each condition:

• Temperature: the standard range is -25 to +85 °C. Class TA covers -40 to +85 °C, TB -40 to +105 °C and TC -40 to +125 °C, each tested over 500 temperature cycles.
• Data retention: classes RA, RB and RC mean no loss of stored data for 10, 12 and 15 years from manufacture.
• Memory updates: classes UA, UB and UC mean 100,000, 500,000 and 1,000,000 updates to the files a device writes most often.
• Humidity, corrosion, vibration and shock: a high-humidity class, salt-atmosphere test levels, and automotive vibration and shock classes.

A SIM states the classes it meets as a short code such as TB-HA-RB, which can also be stored on the chip. Which classes an “industrial” SIM meets varies from product to product, so ask for that code or the datasheet. The standard sets data retention, not a service life: how long a SIM lasts in the field also depends on the heat, damp and write load it sees. The soldered form factor below exists partly for this reason.

Where M2M SIMs are used

Anything that needs a connection where there is no Wi-Fi it can rely on, or where depending on someone else’s Wi-Fi is not acceptable:

• Utilities: smart electricity, gas and water meters, and monitoring on substations and pumping stations.
• Vehicles and logistics: fleet telematics, asset and container trackers, and connected cars.
• Retail and payments: vending machines, card terminals and digital signage.
• Security: alarm panels and cameras, where a cellular link carries alerts when the building’s broadband is down or cut.
• Industry and agriculture: IoT gateways on factory equipment, tank and silo level sensors, weather stations and irrigation controllers.
• Health: remote patient monitoring devices that have to work in any home.

Low-power sensors in this list usually run on NB-IoT or LTE-M rather than ordinary 4G, which affects the choice of SIM and plan; the NB-IoT and LTE-M comparison covers the difference.

Form factors: 2FF, 3FF, 4FF and MFF2

The original full-size SIM, 1FF, was the size of a bank card and is no longer used in devices. The three plug-in sizes in use today are all cut from the same kind of card, with the contacts roughly the same size and less plastic around them each time.

• 2FF, mini SIM: 25 by 15 mm. Still common in industrial equipment and older modules, and the easiest to handle with gloves on.
• 3FF, micro SIM: 15 by 12 mm. Common on development boards and mid-sized devices.
• 4FF, nano SIM: 12.3 by 8.8 mm. The phone standard, used where the holder has to be small.
• MFF2, embedded SIM chip: about 5 by 6 mm, an eight-contact package soldered to the circuit board like any other chip. It is defined by ETSI for machine-to-machine use.

A plug-in SIM needs a holder, and the holder is the weak point: it takes board space, it is a mechanical part that can let the card lose contact under vibration, and its contacts can corrode in damp conditions. An MFF2 removes the holder altogether. The trade is that the SIM cannot be swapped by hand, so changing operator depends on the SIM’s own ability to change profile.

The form factor is independent of what the chip can do. An MFF2 can be a plain single-profile SIM, and a plug-in card can be an eSIM.

M2M eSIM and IoT eSIM: eUICC and remote provisioning

Strictly, eSIM means an eUICC: a SIM that can hold several operator profiles and have new ones downloaded over the air. Each profile is a complete subscription with its own ICCID, IMSI and keys, and normally one is enabled at a time. The chip itself has a fixed identity, the EID. That lets a device change operator remotely.

The GSMA has published three families of specification for this, and which one a device supports decides how profiles get onto it.

The M2M specification, SGP.02, was the first. It manages the eUICC from the network side, through a server that pushes profiles and commands to the device, and it needs close integration between the operators and the platform involved. The consumer specification, SGP.22, is the one phones use. The device downloads a profile from a server called an SM-DP+, usually triggered by a person scanning a QR code or using a carrier app. That works well with a screen and a user, and poorly for a sensor with neither.

The newer IoT specification is meant to fill that gap. SGP.31 sets out its architecture and requirements, and SGP.32 is the technical specification. It reuses the consumer SM-DP+ for profile downloads and adds an eSIM IoT remote manager, the eIM, which tells devices with no user interface which profile to download and which to enable, including devices on constrained networks such as NB-IoT. Support is still arriving across modules, eUICCs and platforms, so check each part of the chain before designing around it.

eSIM vs physical SIM: what actually differs

“eSIM vs physical SIM” mixes two separate questions, and keeping them apart makes the comparison much easier. One is the form: a removable plastic card in a holder, or a chip soldered to the board. The other is the capability: one fixed subscription written in at the factory, or an eUICC that can download and switch between profiles. The two usually travel together, which is why the terms get used as opposites, but they do not have to. An eUICC can be supplied as a plug-in card, and a soldered MFF2 chip can hold one fixed profile and nothing else.

In a phone, the practical differences are these. A physical SIM gets its subscription by being inserted, and moves to a new phone by being moved. An eSIM gets its subscription by download, usually from a QR code or a carrier app, and moving it to a new phone means a transfer or a new download, which each operator handles in its own way. A phone with an eSIM can store several profiles, which is handy for a local data plan abroad or a second number, although usually only one or two are active at once. A thief cannot pull an eSIM out of a stolen phone to stop it being tracked or to use the subscription elsewhere. And some phones no longer take a card at all: Apple’s US iPhone models have had no SIM tray since the iPhone 14.

For a connected device, the same split plays out differently, because nobody is there to scan a QR code or swap a card:

• Getting the subscription on. A physical SIM is fitted at the factory or by an installer. An eSIM receives its profile over the air, through the M2M or IoT specification described above.
• Changing operator. With a fixed SIM, a change of provider means a site visit to every device, or no change at all. With an eSIM it is a download, which is the main reason fleets that will stay in the field for many years choose one.
• Reliability. A soldered chip has no holder contacts to work loose under vibration or corrode in damp air, whether it holds one profile or several.
• Service and repair. A removable card lets a technician move a subscription to a replacement unit in a minute. A soldered SIM stays with the board, so the subscription moves through the connectivity platform instead.
• Cost and complexity. A plain card is the simplest thing to buy and test. An eSIM brings a provisioning server, a profile manager and an operator that supports them into the design.

The table further down sets out where each type fits in a device design.

iSIM: the SIM inside the chipset

An iSIM moves the SIM function into the cellular module’s own chipset, where it runs in a secure area of the module’s own silicon. It supports remote provisioning in the same way as an eSIM, with an EID and downloadable profiles. The attraction is one fewer component: no SIM chip, no holder, no traces between them, and a smaller board.

The catch is that the SIM is now tied to the module. Only certain chipsets support it, the choice of profiles available for it is narrower than for a discrete eSIM, and a module change later means revisiting the SIM as well. It suits compact, high-volume designs where the module is already chosen and supports it.

How to choose an M2M or IoT SIM card for a device design

A few questions narrow it down quickly.

How long will devices stay in the field, and where? A device that will run for ten years in several countries will almost certainly outlive a commercial arrangement or face a roaming rule change, and an eSIM makes that a download. A short-lived device in one country can live with a fixed SIM.

Can anyone reach the SIM? A smart meter sealed in a cabinet, a tracker potted in resin and a sensor on a pylon cannot have their SIMs swapped. A gateway in a comms room can.

What will it endure? Heat, cold, vibration and condensation all favor a soldered part and an industrial-grade chip.

What does the module support? Check which eSIM specification the module and the eUICC support, whether the connectivity platform supports the same one, and whether iSIM is an option on that module at all. Radio choice feeds into this; the NB-IoT and LTE-M comparison covers the low-power networks, the 5G RedCap guide covers the mid-range 5G option, and the IoT protocols explainer covers what runs over them.

Many designs keep a plug-in holder on prototype boards and an MFF2 footprint on production boards, sometimes both, so development can start before the production SIM is settled.

Security for M2M and IoT SIMs

A SIM taken from a device and put in a phone or a modem gives someone a working data connection billed to you, and devices in public places are an easy source. Several settings reduce that and other risks.

SIM PIN. A PIN-locked SIM will not work until the PIN is entered at power-up, so a SIM removed from the device is useless on its own. The device firmware has to supply the PIN, which means storing it on the device, so it stops casual theft but will not stop someone who has extracted the firmware.

IMEI locking. Most management platforms can bind a SIM to the IMEI of the device it was first used in. If the SIM turns up in different hardware, the network refuses it or the platform raises an alert.

Private APN. By default a cellular device may get a public internet address. A private APN puts the fleet on a private network whose traffic is routed only to your own servers, usually over a VPN or a private link. Devices cannot be reached from the internet, and they cannot reach anything you have not allowed.

Limits and alerts. Per-SIM data caps, SMS restrictions and alerts on unusual usage catch a compromised or misbehaving device early.

The SIM’s secret key cannot be read out of the chip, which makes the SIM a small secure element in its own right. The GSMA’s IoT SAFE specification lets devices use it to store credentials for their own application connections as well. Whatever the SIM provides, the device still needs the basics in the IoT device security guide: signed firmware, unique credentials and no open services.