A method of first time subscriber identity module, SIM, provisioning for a mobile device, the method comprising: obtaining, by the mobile device, a non-operational profile, wherein the non-operational profile comprises a shared international mobile subscriber identity, IMSI, and a device root key, KD, uniquely associated with the mobile device are received by the mobile device from a subscription manager data provisioning, SM-DP, server, and enables a limited cellular communication for the mobile device, wherein the device root key is derived by the provisioning server from a unique subscriber root key associated with the IMSI and a device identifier of the mobile device, wherein the IMSI is a shared IMSI used for provisioning of a group of devices including the mobile device, wherein respective unique device root keys are derived for the group of devices from the subscriber root key, and respective device identifier of the group of devices by the provisioning server; transmitting , by the mobile device, an authentication request comprising the IMSI, and the device identifier identifying the mobile device to a first home subscriber server, HSS , wherein the first HSS forwards the authentication request to a second HSS and wherein the second HSS derives the device root key based on the subscriber root key associated with the IMSI and the device identifier; performing, by the mobile device, an authentication under key agreement, AKA, procedure using the device root key with the second HSS, and obtaining, by the mobile device, via the limited cellular communication, an operational profile, wherein the operational profile enables additional cellular communication for the mobile device as compared to the non-operational profile based on the AKA authentication with the second HSS. obtaining, by the mobile device, a non-operational profile, wherein the non-operational profile comprises a shared international mobile subscriber identity, IMSI, and a device root key, KD, uniquely associated with the mobile device are received by the mobile device from a subscription manager data provisioning, SM-DP, server, and enables a limited cellular communication for the mobile device, wherein the device root key is derived by the provisioning server from a unique subscriber root key associated with the IMSI and a device identifier of the mobile device, wherein the IMSI is a shared IMSI used for provisioning of a group of devices including the mobile device, wherein respective unique device root keys are derived for the group of devices from the subscriber root key, and respective device identifier of the group of devices by the provisioning server; transmitting , by the mobile device, an authentication request comprising the IMSI, and the device identifier identifying the mobile device to a first home subscriber server, HSS , wherein the first HSS forwards the authentication request to a second HSS and wherein the second HSS derives the device root key based on the subscriber root key associated with the IMSI and the device identifier; performing, by the mobile device, an authentication under key agreement, AKA, procedure using the device root key with the second HSS, and obtaining, by the mobile device, via the limited cellular communication, an operational profile, wherein the operational profile enables additional cellular communication for the mobile device as compared to the non-operational profile based on the AKA authentication with the second HSS. <EOS>