What is the difference between IPAd and IPAe in SGP.31/32 implementations?

Why IPAd and IPAe Solve Different Deployment Problems

IPAd and IPAe both deliver the same IoT Profile Assistant functions, but they place that logic in different parts of the system. IPAd keeps the assistant on the device itself, so the device maker owns more of the runtime and software stack. IPAe shifts the assistant into the eUICC, which moves more responsibility into the embedded SIM and can better suit constrained hardware.

The practical difference is not the profile-assistant capability, but where the implementation burden sits. IPAd is a better fit when the device has enough compute, memory, and software ownership to host the assistant cleanly. IPAe is a better fit when the device is limited or when the organisation wants to reduce how much custom logic must live on the device.

What Changes for the Device Maker and the Integrator

With IPAd, the maker has more direct control over update logic, device-side integration, and how the assistant behaves in the broader firmware or application environment. That can be an advantage when the product already has a mature software stack and the vendor wants tighter control over implementation choices.

With IPAe, the device maker can offload some of that complexity into the eUICC layer. That changes engineering effort, because the device may need less local implementation, but it also changes dependency boundaries. The integrator must account for what the eUICC supports, how provisioning is handled, and how the device interacts with that embedded execution environment.

In other words, IPAd tends to centralise responsibility in the device platform, while IPAe distributes more of the operational burden into the connectivity and subscription side of the solution. Both can be correct choices, but they answer different product constraints.

How to Choose Between Them in Practice

The choice usually comes down to device capability, product control, and lifecycle ownership. If the device is powerful enough and the vendor wants full software ownership, IPAd is often the cleaner architecture. If the device is constrained, cost-sensitive, or intended to rely more heavily on the eUICC for profile-related behavior, IPAe is usually the more practical route.

Both approaches still need clear boundaries around provisioning, update handling, and integration testing. The important question is not which one is more “advanced”, but which one best matches the device class and the operating model. A design that fits a high-capability gateway may be unnecessary or fragile on a small embedded device.

Practitioner Guidance

What to verify: Validate where the assistant logic actually runs, what the eUICC implementation exposes, and whether the device can support the required lifecycle operations without excessive vendor-specific workarounds. The implementation decision should be based on deployment fit, not on naming preference.

Decision rule: If the device can reliably host the assistant and the maker wants software control, choose the device-side model; if the device is constrained and the goal is to shift responsibility off-device, choose the eUICC-side model. Treat any architecture that mixes the two without a clear ownership model as a design risk.

Practitioner takeaway: IPAd and IPAe are mainly about where execution responsibility lives, so the right choice is the one that best matches hardware capacity, ownership boundaries, and operational complexity.

Related resources from NHI Mgmt Group

• What is the difference between privilege reduction and secret rotation?
• What is the difference between a rules-based secret scanner and a hybrid scanner?
• What is the difference between code scanning and runtime identity monitoring?
• What is the difference between zero trust for users and zero trust for NHIs?