A method of changing a mobile network operator, MNO, using an embedded Subscriber Identity Module, eSIM, linked to at least one MNO, the eSIM storing a provisioning profile and a profile (331, 341) of the at least one MNO, the method comprising: receiving, by the eSIM, a security domain, SD, of a receiving MNO from a donor MNO, wherein an SD is a privileged application which has cryptographic keys used to support a secure channel protocol operation or to authorize a card content management function, the receiving MNO being the MNO after a MNO change, the donor MNO being the MNO before the MNO change, and wherein the SD of the donor MNO manages a first profile of the donor MNO by using a cryptographic key of the SD of the donor MNO, by the donor MNO, the SD of the receiving MNO by performing an SD extradition to disassociate the SD of the receiving MNO from an issuer security domain, ISD; connecting, by the eSIM, to the receiving MNO using the provisioning profile; conducting, by the eSIM, SD authorization using the cryptographic key of the SD of the receiving MNO and receiving a second profile or data using the privilege of the SD of the receiving MNO, wherein the SD of the receiving MNO manages the second profile of the receiving MNO by using the cryptographic key of the SD of the receiving MNO; inactivating, by the eSIM, the first profile of the donor MNO when the eSIM receives the SD of the receiving MNO having a delegated management privilege or an authorized management privilege over the receiving MNO, from the donor MNO system; and changing, by the eSIM, a key value of the cryptographic key of the SD of the receiving MNO to a unique key value recognized only by the receiving MNO after the eSIM is issued with the second profile or data for the receiving MNO. receiving, by the eSIM, a security domain, SD, of a receiving MNO from a donor MNO, wherein an SD is a privileged application which has cryptographic keys used to support a secure channel protocol operation or to authorize a card content management function, the receiving MNO being the MNO after a MNO change, the donor MNO being the MNO before the MNO change, and wherein the SD of the donor MNO manages a first profile of the donor MNO by using a cryptographic key of the SD of the donor MNO, by the donor MNO, the SD of the receiving MNO by performing an SD extradition to disassociate the SD of the receiving MNO from an issuer security domain, ISD; connecting, by the eSIM, to the receiving MNO using the provisioning profile; conducting, by the eSIM, SD authorization using the cryptographic key of the SD of the receiving MNO and receiving a second profile or data using the privilege of the SD of the receiving MNO, wherein the SD of the receiving MNO manages the second profile of the receiving MNO by using the cryptographic key of the SD of the receiving MNO; inactivating, by the eSIM, the first profile of the donor MNO when the eSIM receives the SD of the receiving MNO having a delegated management privilege or an authorized management privilege over the receiving MNO, from the donor MNO system; and changing, by the eSIM, a key value of the cryptographic key of the SD of the receiving MNO to a unique key value recognized only by the receiving MNO after the eSIM is issued with the second profile or data for the receiving MNO.