Can I add an eSIM to my work phone? Why the button is missing, and what to ask IT
Four different things stop an eSIM going onto a company phone: a supervised device with the restriction on, a carrier lock, an Android or Knox policy, and a full slot. How to tell which, with the vendor documentation.
Usually yes, and when the answer is no it is one of four causes, each with a different fix and a different person to ask. A supervised iPhone with the eSIM restriction applied, a phone still locked to the carrier that sold it, a policy on a company-owned Android or Samsung device, or a phone with no free eSIM slot left. None of them is a fault, and only the last one is something the employee can solve alone.
This guide is for the traveller finding out the day before departure, and for the IT person who has to answer them. Every menu path and every policy name below comes from Apple, Google, Microsoft or Samsung documentation, with the dates, and the claims those documents do not support are called out rather than smoothed over.
What "Add eSIM" looks like when nothing is blocking it
Apple's current instruction for an iPhone is three steps: "Open the Settings app on your new iPhone. Tap Cellular. Tap Set Up Cellular or Add eSIM" (Apple, Set up eSIM on iPhone, 17 September 2026). The label under Settings differs by region, so where Apple's US English says Cellular you may see Mobile Data or Mobile Service.
If that entry is there and works, nothing below applies to you. If it is missing, refuses, or produces a plan that never installs, read on.
Cause 1: the iPhone is supervised, and the restriction is switched on
This is the common one on a company-issued iPhone, and the important detail is that it only exists on a supervised device.
The restriction is allowESIMModification, in the Restrictions payload. Apple's schema says: if false, "the system disables modifications of eSIMs", available from iOS 12.1 and iPadOS 12.1, and it requires supervision (Apple Developer, Restrictions, no date shown). In Apple's own deployment guide the same thing appears with a human label, "Modify eSIM settings", described as "Users can't add or remove an eSIM plan for an iPhone that supports eSIM", again marked as requiring supervision (Apple, Restrictions for iPhone and iPad, 17 December 2025).
There is a second, newer one worth knowing about if the problem is moving an eSIM to a different handset rather than adding one: allowESIMOutgoingTransfers, from iOS 18, which "prevents the transfer of an eSIM from the device on which the restriction is installed to a different device". Also supervision only.
What the employee actually sees is not a greyed out button. This is where most advice on the internet is wrong, and Apple is specific about it. With the restriction on, a plan pushed by a carrier still appears: "Users see a notification in Settings for any eSIM distributed by the carrier using eSIM Carrier Activation. Although they see that a 'Cellular Plan is Ready to be Installed,' the restriction prevents users from installing the eSIM" (Apple, A device management service, 25 September 2024). A plan that is permanently ready and never installs is the signature of this restriction, not of a bad QR code.
The same page notes that administrators are not blocked by it: they can still install eSIMs with the Refresh Cellular Plans command. So a company that restricts eSIMs has not lost the ability to give you one. It has moved the decision to IT, which is usually the point.
A related restriction sometimes confused with it is allowCellularPlanModification, which stops users changing settings related to their cellular plan and is described by Apple as available only on select carriers. Also supervision only.
If your company manages iPhones through Microsoft Intune, the setting your IT person is looking for is called "Block modification of eSIM settings": "Yes prevents removing or adding a cellular plan to the eSIM on devices", listed for iOS 12.1 and newer, in the section headed "Settings apply to: Automated device enrollment (supervised)" (Microsoft, iOS and iPadOS device restriction settings, ms.date 14 May 2026, updated 1 July 2026). Microsoft also lists it among its level 3 high security recommendations for supervised iOS devices, which is why it is sometimes on without anyone having thought about travel.
One correction, because it wastes a lot of IT time: Microsoft's page called "Enable eSIM data connections in Microsoft Intune" states "This feature applies to: Windows". It is not an iPhone feature and searching for it will not help you (Microsoft, ms.date 25 June 2024, updated 1 July 2026).
Cause 2: the phone is still locked to a carrier
Nothing to do with management. A locked handset will not run a second carrier's profile, and Apple states the rule in one sentence: "To use two carriers, your carrier must unlock your iPhone, or both plans must be from the same carrier" (Apple, Using Dual SIM with an eSIM, 17 September 2026).
You can check this yourself in under a minute. Apple's instructions: look in Settings, General, About, and if it says "No SIM restrictions" next to Carrier Lock, the iPhone is unlocked (Apple, 22 January 2026).
Company phones bought on a contract are often locked for the duration of that contract. Unlocking is a request to the carrier, made by whoever holds the account, which is the company and not you. It is not instant, so this is the cause that most rewards asking early.
Cause 3: an Android or Samsung policy on a company-owned device
The Android equivalent of Apple's restriction is explicit. In the Android Management API, userInitiatedAddEsimSettings "controls whether the user is allowed to add eSIM profiles", and its blocking value, USER_INITIATED_ADD_ESIM_DISALLOWED, is "supported only on company-owned devices" (Google, Android Management API policies reference, last updated 28 September 2026). There is also mobileNetworksConfigDisabled, which disables configuring mobile networks generally.
A note for anyone comparing documentation: DISALLOW_CONFIG_MOBILE_NETWORKS and DISALLOW_CONFIG_TETHERING are Android platform constants, not Android Management API policy names. The API fields are the ones above. Quoting the constants at an MDM administrator will produce a blank look.
On Samsung, the control lives in the Knox Service Plugin's advanced restriction policies. "Allow eSIM operation" is described as: "Set False to block eSIMs on the device, restricting the device to only the physical SIM", supported on One UI 6.0 or later. A finer grained "SIM management operation" policy, on One UI 7.0 with Knox 3.11 or later, can configure how many eSIMs are allowed on the device. A third, "Allow dual SIM operation", set to False, "blocks all mobile service (mobile data, calls, SMS) on the second SIM slot", which is the one that makes an installed travel eSIM look broken rather than blocked (Samsung Knox, advanced restriction policies, 4 September 2026).
Worth knowing if IT offers to push the plan for you: Intune's "Update cellular data plan" remote action supports iOS and iPadOS, and on Android Enterprise the Activate eSIM action needs Android 15 or later and corporate-owned devices, with "personally owned devices with a work profile (BYOD) aren't supported" (Microsoft, ms.date 16 September 2026, updated 25 September 2026).
Cause 4: there is no free slot
The least discussed and the easiest to fix. A phone holds a limited number of eSIM profiles, and a work phone that has been through a carrier migration or two often has old ones sitting in it.
Android says this out loud. The Android Management API returns ERROR_MULTIPLE_ACTIVE_ESIMS_NO_AVAILABLE_SLOT when a new eSIM cannot be added "since multiple eSIM slots on the device contain active eSIM profiles and there is no free eSIM slot available", and the documented resolution is to add the new eSIM without activating it, or to deactivate an existing one first (Google, Android Management API, 28 September 2026).
Apple publishes no equivalent error message, and its own numbers deserve care. The Dual SIM article says "iPhone 13 models and later also support Dual SIM with two eSIMs, in addition to a physical SIM and an eSIM", and that "your iPhone can use one cellular data network at a time" (Apple, 17 September 2026). On storage, the only wording Apple gives is that eSIM lets you "manage up to eight or more eSIMs" (Apple, 17 September 2026), which is Apple's phrasing and not a specification. The widely repeated "eight stored, two active" is not something Apple states in that form, so do not plan a rollout around it.
The practical version: two lines active at once, and deleting a profile you no longer use frees room. If a travel eSIM installs and then shows no service, that is a different problem entirely and our guide on eSIM installed but no service goes through it in order.
How to tell which one applies, in two minutes
Do these in order, on the phone, before contacting anyone.
| Check | Where | What it means |
|---|---|---|
| Is there a supervision message at the top of the main Settings page? | Settings, first screen | The device is supervised, so cause 1 is possible |
| Is a management profile installed? | Settings, General, VPN and Device Management | The device is managed, and the profile says what it changes |
| Does Carrier Lock say "No SIM restrictions"? | Settings, General, About | If not, cause 2 |
| Does a plan sit there saying it is ready to install, forever? | Settings, Cellular | Cause 1, almost certainly |
| Are there old eSIM profiles you do not use? | Settings, Cellular | Possibly cause 4, and you can fix it yourself |
Apple documents the first two checks directly: an organisation-issued device "might be supervised", by default a device is not, the supervision message "is found at the top of the main Settings page", and the profile is at "Settings, then General, then VPN and Device Management" (Apple, If you have a supervised iPhone, iPad, Mac or Apple Vision Pro, 14 April 2026). One thing worth stating accurately: Apple confirms the message exists but does not publish its exact wording, so do not go looking for a specific sentence.
Apple also notes that supervision can only be turned on when a device is set up. If a phone is not supervised today, nobody is going to quietly supervise it before your flight.
The exact question to ask IT
Vague questions get vague answers, and "can I put an eSIM on my work phone" is a vague question. Send this instead, a week out:
- Is this device supervised, and is the eSIM modification restriction applied to it? On Intune the setting is called "Block modification of eSIM settings".
- Is the handset carrier locked? If so, can the account holder request an unlock before the trip, and how long does that take?
- If eSIMs are restricted, will you install a travel data plan for me using the Refresh Cellular Plans command, or approve an exception for the trip?
- Is personal hotspot restricted on this device?
- Is data roaming permitted on the company line, and in which countries is it included?
Questions one to three decide whether an eSIM is possible at all. Four and five decide whether the trip works even if it is. If the answer to three is that IT will install it, they need the plan's activation details from you, and that is the point at which buying early rather than at the gate pays for itself.
While you are there: hotspot greyed out
The same shape of problem, and it catches people out on the first laptop day rather than on landing.
Apple has allowPersonalHotspotModification, which if false "disables modifications of the personal hotspot setting", from iOS 12.2 and supervision only (Apple Developer, Restrictions). Its human label in the deployment guide is "Modify personal Hotspot settings" (Apple, 17 December 2025).
Intune has two separate settings for this and they behave differently. "Block personal Hotspot" turns the hotspot off at every device sync, and Microsoft adds a detail that explains a lot of confused troubleshooting: "The Intune service treats this setting as a remote device action. So, the management profile on devices doesn't show this setting." A user who inspects the management profile to find out why will find nothing. The second, "Block modification of personal hotspot", is supervision only, and Microsoft notes that with both set to Yes the hotspot is simply off (Microsoft, ms.date 14 May 2026).
On Android, tetheringSettings controls it, with DISALLOW_ALL_TETHERING supported on fully managed devices and on work profiles on company-owned devices. The older tetheringConfigDisabled is marked deprecated in favour of it (Google, 28 September 2026).
If the hotspot does work and you are planning to run a laptop through it, the amount of data that disappears into background sync is its own subject: working from a laptop abroad has the realistic numbers.
If the phone is yours and the trip is for work
A different and simpler situation, and increasingly the common one. A personal handset has no supervision and no company restriction, so adding a travel eSIM is a normal purchase and a normal install. What it does have is your own line in it, with your own number, and that line should stay switched on: it is what keeps the calls and the verification codes arriving while the travel profile carries data. The setup is in our guide to travel eSIMs and SMS codes, and the wider question of which kind of "business eSIM" a company should be buying at all is in business eSIM explained.
If you are stuck on a specific device and cannot work out which of the four causes it is, describe what the phone shows and we will tell you what it looks like from here: support.
Sources: Apple Developer, Restrictions payload (allowESIMModification, allowESIMOutgoingTransfers, allowCellularPlanModification, allowPersonalHotspotModification), no date shown on the page; Apple, "Restrictions for iPhone and iPad", 17 December 2025; Apple, "A device management service", 25 September 2024; Apple, "Prepare to use eSIMs with Apple devices", 17 September 2026; Apple, "Set up eSIM on iPhone", 17 September 2026; Apple, "Using Dual SIM with an eSIM", 17 September 2026; Apple, "How to check if your iPhone is unlocked", 22 January 2026; Apple, "If you have a supervised iPhone, iPad, Mac or Apple Vision Pro", 14 April 2026; Microsoft, "iOS and iPadOS device restriction settings", ms.date 14 May 2026, updated 1 July 2026; Microsoft, "Update cellular data plan", ms.date 16 September 2026, updated 25 September 2026; Microsoft, "Enable eSIM data connections", ms.date 25 June 2024, updated 1 July 2026; Google, Android Management API policies and devices reference, last updated 28 September 2026; Samsung Knox, advanced restriction policies, 4 September 2026. Management settings differ by MDM product, by device model and by operating system version, and your own IT department is the authority on what is applied to your handset. Checked 29 September 2026.
Quick answers
Why is Add eSIM missing or greyed out on my work iPhone?
Most often because the iPhone is supervised and your company has applied the eSIM modification restriction, which Apple documents as requiring supervision. The tell is a plan that sits in Settings saying it is ready to be installed and never installs, which is what Apple says users see when the restriction is on. The other causes are a carrier locked handset, which you can check under Settings, General, About, and a phone with no free eSIM slot.
Can my company stop me adding an eSIM to my phone?
On a company-issued device, yes. Apple's restriction, Microsoft Intune's "Block modification of eSIM settings" and Android Enterprise's own "disallow adding eSIM" policy all do exactly that, and the Android one is documented as working only on company-owned devices. On a phone you own personally, with no management profile on it, none of these apply.
Can I use a travel eSIM on a carrier locked phone?
No. Apple states that to use two carriers the iPhone must be unlocked, or both plans must come from the same carrier. Unlocking is requested from the carrier by whoever holds the account, which for a work phone is the company, so ask well before the trip rather than at the airport.