eSIM transfer during Quick Start cellular not active on new phone

By Sai Kiran Pandrala · Last verified: 2026-05-31 · Source: community Q&A, Apple Support docs, Apple Communities (discussions.apple.com)

Engineers running iOS Setup Migration and Backup hit eSIM transfer during Quick Start cellular not active on new phone often enough that there is a stable fix pattern. This page captures it in the order Apple support would run it during a real incident.

What esim transfer during quick start cellular not active on new phone actually involves on iOS Setup Migration and Backup

This task on iOS Migration Setup Backup is one of the more searched operational topics on AWS in the last 12 months. The procedure below is the path that works in a current AWS account with default IAM and standard VPC config.

The rest of this page is the structured fix path. Start with diagnose, then remediation, then the automation options so you do not have to do this by hand the next time it surfaces. Verify and safety sections at the end are the discipline that keeps the fix from regressing in production.

Diagnose first, fix second

Look at the Jamf Pro change management entry or Apple Business Manager audit event for the failed call, even if you are not enrolled in macOS unified logging and iOS sysdiagnose Log Router. The basic 90-day event history works for most diagnostic purposes and lives in the console under Jamf Pro change management log and Apple Business Manager audit log > Event history. Filter by event name (the API action) and time range; the event JSON shows the exact user identity, source IP, request parameters, and error code.

Check Activity Monitor / Jamf inventory Logs for the calling service. Lambda, ECS, EKS, Step Functions, API Gateway, and most managed services write detailed traces to Activity Monitor / Jamf inventory Logs under predictable log group names. Use Activity Monitor / Jamf inventory Logs Insights with fields @timestamp, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 50 to surface the most recent failures.

Reproduce the failure with the Terminal commands (defaults, plistbuddy, killall, sudo, system_profiler) and Apple Configurator 2 / Jamf APIs / MDM commands in --debug mode. The full SigV4 request payload it emits, plus the exact endpoint URL it resolved to, is what Apple Support and Apple Business / Enterprise Support uses to verify policy, region, or parameter issues without you having to share IAM credentials. Save the debug output to a file with ... --debug 2> debug.log and you can search it for the failed aws.request entry.

Solution-focused remediation path

Most iOS Setup Migration and Backup failures fall into one of three buckets: IAM permission gap, networking path break (security group, NACL, or VPC endpoint policy), or service-limit / quota hit. Run that mental triage first - it covers around 80 percent of real-world cases. If the failure does not fit any of the three, it is likely a service-side regression worth opening a re:Post or support ticket for.

If quotas are suspect, the Apple Business Manager Settings > Manage Devices console shows current usage and the active limit side by side. Request increases through Apple Business Manager Settings > Manage Devices, not through Support tickets - quota dashboard requests usually approve faster (often within minutes for soft limits) and they are auditable in Jamf Pro change management log and Apple Business Manager audit log. Set up Apple Business Manager Settings > Manage Devices + Jamf Pro Smart Group + Webhooks at 80 percent usage so you get notified before you hit the wall.

If the issue points at IAM, do not start by adding * to a policy. Use macOS Console + Jamf Pro logs + Profile Manager check against the failed action to see the minimum scope. Adding * is the fastest way to fail your next Apple Platform Security review, and it usually does not even fix the issue because the explicit deny is often coming from a higher level (Org Policy, RCP, or permission boundary), not a missing allow.

Automate this fix so you do not do it twice

Build a Self Service item with manual approval for risky fixes

For multi-step fixes that include a destructive action (Reset NVRAM, delete keychain, erase user data), publish the fix as a Self Service item in Jamf Pro or Kandji. The user clicks one button, the script runs, a notification confirms success. Couple it with a Jamf Pro approval workflow if your security model requires a second-person sign-off before any destructive step runs. The audit trail lives in the MDM change log with the requester and approver identity attached.

Add a Smart Group + webhook so you catch the next occurrence

The cheapest way to never see the same incident twice is a Jamf Pro Smart Group that watches for the symptom (specific extension attribute value, specific OS version, specific app build) and fires a webhook into Slack, PagerDuty, or a Jamf-API-driven Lambda when the count drifts above your normal baseline. For iOS Setup Migration and Backup, the relevant extension attributes live under script-evaluated checks - defaults read outputs, system_profiler values, or a log show grep against macOS unified logging. Set thresholds against observed normal, not against round numbers.

Codify the fix as a Shortcut on iPhone, iPad, or Mac

For workflows that happen on the user device rather than at the MDM layer (think: clear a stuck cache, toggle a setting, file a one-tap support ticket), Apple Shortcuts is the right place. Shortcuts run on iOS, iPadOS, macOS, and watchOS, can be triggered by NFC tag, focus mode, time of day, or Siri voice. Share via iCloud link so support sends the same one-tap fix to anyone who hits the issue.

Common pitfalls and what to watch for

A subtle pitfall on iOS Setup Migration and Backup is that the Settings on the device and the SDK can disagree about resource state during a configuration change. Console UI is cached for performance and may show the old config for up to 10 minutes after you change it via API or Deployment Manager or Terraform. Always confirm with describe-* CLI calls during a change window, not with screenshots from the Console.

The other pitfall: assuming that an automated remediation is correct because it succeeded. A Lambda that fires on a Jamf Pro Smart Group + Webhook and runs a remediation step should also publish a metric for every remediation; sudden surges in auto-fix invocations are themselves an outage signal. Otherwise you can hide a slow-burn regression behind a quiet remediation loop for weeks.

Verify the fix worked

• Watch for 24 to 48 hours. Activity Monitor + macOS unified logging + Jamf inventory reports can mask issues with cached health for 6 to 12 hours, especially Cloud CDN and Cloud DNS.
• Capture the new state in a runbook so the next person on call does not have to rediscover this. Push it to Confluence or your team wiki, not into Slack.

Safety, rollback, blast radius

• Test in a non-production account if your environment has Resource Manager and Organization Policy or Cloud Resource Manager (organizations, folders, projects). The cost of one sandbox account is cheaper than one rollback meeting.
• Export the existing config before changing it. Most iOS Setup Migration and Backup resources support describe + export to JSON via CLI - capture that to source control before you start.
• Maintenance window discipline: if the change touches DNS, certificate rotation, or anything that emits TLS handshakes, line up a window with stakeholder notification, not a heroic mid-day swap.

FAQ

Related fixes

Related guides worth a look while you sort this one out:

• Apple Watch unpaired during Quick Start re-pair fix
• Skip Quick Start and set up as new iPhone later
• Quick Start animation will not scan white circle problem
• Quick Start says finishing up on iPhone for hours
• Quick Start stuck on looking for nearby devices iPhone 16
• Quick Start vs iCloud restore vs Finder restore which to choose