OTA Updates for IoT: The Complete Guide to Remote SIM Provisioning

This guide names both so you understand the full picture, but its focus, and Com4's focus as a cellular IoT connectivity provider, is squarely on the second: how over-the-air SIM provisioning actually works, the difference between Multi-IMSI and eUICC, and how real Com4 customers manage connectivity remotely at scale.

Key takeaways:

• OTA in IoT covers two distinct layers: firmware OTA, which changes what a device does, and SIM OTA, which changes how a device connects. They are usually handled by different parties.

• Firmware OTA is typically the responsibility of the device manufacturer or an IoT device management platform, not the cellular connectivity provider.

• Traditional SIM OTA provisioning runs over A2P SMS or HTTP, both of which work without requiring a persistent data session.

• eUICC (often called eSIM) allows a single SIM to host multiple operator profiles that can be added, removed, or switched entirely over the air.

• Multi-IMSI and eUICC solve a similar problem, automatic network switching, but differ in who controls which networks a device can use.

What is OTA in IoT, and why does it matter?

For any IoT deployment beyond a handful of pilot devices, physical access is the constraint that shapes almost every other decision. A device buried in a utility cabinet, mounted on a wind turbine, installed in a basement, or scattered across hundreds of retail locations cannot be visited every time something needs to change. OTA solves this by using a device's own connectivity to receive updates remotely, at scale, on a schedule someone else controls.

It helps to be precise about which "something" is changing, because two different parts of the stack are involved, and typically two different parties own them:

1. Firmware OTA (FOTA). Updating the software running on the device itself, owned by the device manufacturer or whichever IoT device management platform sits on top of the connectivity.
2. SIM OTA. Updating the configuration, activation status, or network profile of the SIM connecting the device, owned by the cellular connectivity provider. This is where Com4 operates.

Both rely on the same underlying principle, remote delivery over an existing connection, but they sit at different layers, and conflating them leads to the wrong conversation with the wrong vendor. If a device needs new application logic or a security patch to its own software, that is a device or platform-level FOTA question. If a device needs to be activated, switched to a different network, or have its connectivity profile changed, that is a SIM OTA question, and it is the layer Com4's connectivity plans and Polaris CMP are built around.

Firmware OTA, briefly: what it is and who owns it

Firmware is the software embedded in a device that tells it what to do and how to behave. Over a device's operational life, firmware typically needs to change for reasons that have nothing to do with connectivity: adding new features, fixing bugs, patching security vulnerabilities, or preparing hardware to fall back to a different network standard ahead of a 2G or 3G shutdown.

Firmware OTA delivers these changes over the device's data connection, usually via a secure download initiated from a device management platform, verified before it is applied, and, in well-implemented systems, rolled back automatically if the update fails. This is real and important capability, but it is generally the responsibility of the device manufacturer or an IoT device management platform sitting above the connectivity layer, not the cellular connectivity provider. Com4 does not deliver device firmware updates; Com4's role is making sure the underlying cellular connection those updates would travel over is reliable, secure, and remotely manageable in the first place. The rest of this guide focuses on that connectivity layer, since it is where Com4's OTA capability actually lives.

SIM OTA: how over-the-air SIM provisioning actually works

SIM OTA is Com4's core OTA capability, and it predates smartphone-style app updates by years. For a traditional, single-profile IoT SIM, OTA provisioning is typically carried out through one of two delivery mechanisms:

• A2P SMS (Application-to-Person Short Message Service). The connectivity provider sends the SIM a specially formatted SMS message containing the update or command. Because it rides on the SIM's signaling channel rather than a data session, A2P SMS-based OTA works even when the device is not actively online or does not have an open data connection, which makes it a reliable fallback channel for provisioning commands.
• HTTP-based provisioning. The SIM or device connects to a central provisioning server over a standard data session to retrieve configuration updates, typically used when larger payloads or more frequent updates are involved than SMS comfortably supports.

Both mechanisms allow Com4 to activate a new SIM, suspend or resume a connection, adjust network settings, and push updated security parameters, all without anyone physically accessing the device or the SIM inside it. This is the layer where cellular IoT connectivity providers add real operational value: not by touching device firmware, but by making sure the SIM itself can be provisioned, reconfigured, and kept online remotely for the life of the deployment.

Multi-IMSI vs eUICC: two different approaches to OTA network switching

Both Multi-IMSI and eUICC use OTA to let a single SIM connect across multiple mobile networks, but they solve the problem differently, and the difference matters for how much control you retain over your connectivity.

Com4 supports both approaches, and both are carrier-agnostic within Com4's network estate: SIMs can automatically switch across more than 750 networks in over 190 countries without manual intervention, while eUICC and eSIM formats add the ability to provision or change operator profiles entirely over the air. For static or fixed-site IoT deployments, Multi-IMSI is often enough, giving you an automatic backup path if a primary network has an outage. For fleets that need to launch the same hardware into multiple markets, or that may need to switch providers over a long device lifecycle, eUICC's full profile portability is the stronger long-term fit. Com4's guide to Multi-IMSI SIMs covers this decision in more depth, and the eSIM technology page has the eUICC specifics.

OTA provisioning with eUICC and eSIM

eUICC, the Embedded Universal Integrated Circuit Card, is the piece of technology that makes eSIM more than just a smaller SIM. It allows a single physical or embedded SIM to host multiple operator profiles, and, through a remote SIM provisioning (RSP) platform, those profiles can be added, removed, or switched entirely over the air.

This matters most at the manufacturing stage of an IoT deployment. A device can ship with a single bootstrap profile loaded at production, then have its operational, market-specific profile provisioned remotely once it reaches its actual deployment location, whether that is a different country, a different primary network, or simply a different customer contract. Without eUICC, that same flexibility would require physically swapping the SIM in every unit before or after shipping.

Is SIM OTA right for your IoT deployment?

In most industrial, commercial, and consumer IoT applications, devices are difficult, expensive, or simply impractical to physically access once deployed, which is exactly the scenario SIM OTA is built for. Two questions are worth separating before you scope a deployment:

1. What needs to change on the device itself over its lifetime? That is a firmware and application question, and it sits with your device manufacturer or IoT platform, not your connectivity provider.
2. What needs to change about how the device connects? That is where Com4 comes in: activation, suspension, network switching, and profile management, all deliverable over the air through SIM OTA, with no site visit required.

Keeping these two questions separate when you scope a project makes it much easier to have the right conversation with the right vendor, and to understand exactly what a cellular IoT connectivity partner like Com4 is, and is not, responsible for.

Real-world SIM OTA and remote connectivity management: Com4 customer examples

Bane NOR: OTA network switching across borders, in motion. Bane NOR needed a new generation of energy meters on Norwegian trains to communicate using a new CENELEC protocol, with some routes crossing into other European countries mid-journey. That requirement only works if the SIM can hand off between different network operators automatically as the train crosses a border, without anyone physically intervening, which is precisely the problem Multi-IMSI and eUICC-based OTA network switching are built to solve.

Dignio: OTA connectivity lifecycle management for a regulated medical device. Dignio's Pilly smart pillbox is deployed across more than 50 Norwegian counties and into Denmark, running on Com4's SIM technology over a private network with private APNs, end-to-end encryption, and auditable connectivity logs supporting GDPR, MDR, and IEC compliance. Com4 provides lifecycle management that keeps the connectivity layer compliant from first activation through end of life, meaning SIM status, security parameters, and network configuration can be managed remotely for the device's entire operational life, without a home visit just to update connectivity settings.

Gomero: remote connectivity management across nine countries. Gomero collects real-time equipment data for more than 100 companies across nine countries, enabling predictive rather than scheduled maintenance. Running that many connections across that many markets depends on centralized, remote management of SIM status and network performance rather than manual, per-device intervention.

ZetaDisplay: reliable connectivity as the foundation for the customer's own remote updates. ZetaDisplay's digital signage runs in locations including bus stops, the Oslo Airport Express Train, and Oslo Central Station, connected via industrial 4G modems and Com4 SIMs. Time-critical information, such as train departures, can be updated within seconds through ZetaDisplay's own cloud-based content management system, over the same secure, VPN-protected connection provisioned and managed by Com4. Com4 is not the one pushing those content updates, that is ZetaDisplay's platform, but the always-on, remotely manageable SIM connectivity underneath is what makes that kind of near-instant remote update possible at all.