Somewhere right now, a build estimate for an entitlement server is sitting in a slide deck, and it looks reassuringly affordable. A team scoped the work, added a contingency, and produced a number that beats the subscription quote from a managed provider. Sign-off feels easy. The problem is that the build number is the least important figure in the entire business case, and treating it as the headline is how operators end up three years deep in a run-rate nobody modelled.

The entitlement server does not cost what it costs to stand up. It costs what it costs to keep running correctly, year after year, as the specification moves, as new handsets ship, and as your traffic climbs with the eSIM wave. This piece is the full accounting: every line item in the true total cost of ownership, including the ones that never make it onto the slide. If, after reading it, the in-house path still wins for you, at least you will have signed off with the real number in front of you. And if it does not, Entitlement-Server-as-a-Service is the shape of the alternative.
‍

The short version

The true cost of running an entitlement server in-house is dominated by recurring “carrying costs,” not the initial build. The four that matter most are ongoing GSMA TS.43 specification maintenance, a continuous OEM certification lab, 24/7 low-latency operations, and peak capacity for launch events. None of these scale down when your traffic is quiet, which is why a total cost of ownership calculated over three to five years usually looks very different from the build estimate that got the project approved. The build is a one-time cost. Everything expensive about an entitlement server is recurring.

That is the thesis. Now let us price it out.
‍

Why the build estimate is the wrong anchor

Build cost is real, but it is a rounding error against the multi-year total. It happens once. The costs that dominate the total are the ones that recur every quarter for as long as the service lives, which is to say indefinitely, because you cannot turn Wi-Fi Calling off once customers depend on it.

We have made this argument before in a different domain. Our breakdown of the true cost of SMS OTP showed the same pattern: the visible per-message price is trivial next to the fraud, failure and churn costs hiding underneath it. The entitlement server has its own version of that iceberg, and the visible build cost is just the tip poking above the water.

The point of running the full total-cost-of-ownership exercise is not to talk you out of building. It is to make sure that whether you build, license, or move to a managed route like Entitlement-Server-as-a-Service, you are comparing like with like: five years of run cost against five years of run cost, never a subscription against a one-off. Most build-or-buy debates quietly cheat on this, and the cheat always favours building.

So let us map what is under the surface, in three buckets: one-time setup, recurring carrying costs, and the hidden costs that rarely get named at all.
‍

Bucket one: the one-time setup costs

These are the costs the build estimate usually does capture, at least partially.

Build or license. Either you implement GSMA TS.43 yourself or you license a product and stand it up. Our step-by-step implementation guide gives an honest sense of the scope, and it is more than a sprint.

Integration. The server has to talk to your estate: subscriber data, network identity, provisioning, SIM provisioning, charging, and notification, plus the authentication path from the device inward. Getting the device authentication handshake, from EAP-AKA to the access token, exactly right is non-negotiable, because everything downstream depends on it. Our deployment and run-book checklist is a good gauge of how much integration surface there really is.

Initial certification and interoperability testing. Before you go live, the server has to behave correctly against the device families your subscribers actually carry, and Apple and Samsung each bring their own quirks, as we covered in how entitlement servers support Apple and Samsung devices.

Security and compliance setup. The initial threat modelling, residency design, and audit posture, which our guide to security in entitlement servers lays out in full.

Add these up and you have the number on the slide. Now for the number that is not.
‍

Bucket two: the recurring carrying costs

This is where the real money lives, and it keeps living there every quarter.

Specification maintenance. GSMA TS.43 is a living standard. As of early 2026 it had reached version 13.0 (GSMA), and it keeps advancing. Every revision is engineering work: read it, interpret it, implement it, regression-test it against live traffic. TS.43 also interlocks with a web of related specifications, which we mapped in how TS.43 relates to RCC.14, IR.51 and IR.92. Owning the server means owning that entire reading list, forever, with people who understand it well enough to change production safely.

A continuous OEM certification lab. This is the cost operators underestimate most. Every new handset generation can shift TS.43 behaviour, so validating new device families is not a one-off. It is a standing function with staff, a device inventory, and a queue that never empties. Skip it, and you find out about the gap when a flagship launch breaks activation for your newest, most valuable customers.

24/7 real-time operations. The entitlement decision has to land inside a device’s timeout window, which means low latency, high availability, and a real on-call rotation staffed by people who can debug a live telecom service at 3 a.m. Building this to survive contact with reality is genuinely hard, which is why we wrote up architecting a scalable entitlement system.

Capacity and resilience for the peaks. Average load is not your problem. Launch day is. When a popular device ships and activation volume spikes, your headroom decides whether the moment is a win or a trending complaint, and multi-region resilience is what keeps a regional outage from becoming a national one. Our notes on deployment models cover the trade-offs, all of which cost money to hold in reserve.

Ongoing security, fraud and residency compliance. Not the one-time setup, but the continuous vigilance: monitoring, audits, keeping residency guarantees intact as you add markets, and handling the edge cases that appear when subscribers roam or drop to Wi-Fi only, as in how roaming impacts entitlement flows.

Activation orchestration upkeep. The long-running ODSA flows that provision primary, companion and IoT devices are multi-step, and every one needs a clean rollback path that keeps working as the flows evolve. Maintaining that is its own quiet, permanent line item.
‍

Bucket three: the hidden and opportunity costs

These almost never appear in a build estimate, and they are frequently the largest of all.

Engineering opportunity cost. The people good enough to run a real-time telecom entitlement service are the same people you want on the network and the customer experience. Every hour they spend on TS.43 conformance is an hour not spent on something that actually differentiates you.

Deferred revenue. While you build, you are not launching. eSIM, Wi-Fi Calling, and wearable propositions sit in the backlog, and the business value a working entitlement server unlocks arrives months late. Faster onboarding and activation, the kind covered in reducing customer onboarding time, is revenue you could have been earning during the build.

Key-person risk. In-house entitlement systems tend to concentrate in a handful of heads. When one of them leaves, a large slice of your operational safety leaves with them. That fragility has a cost, even if it only shows up on the worst day.

The cost of failure. The tail risk is real: silent outages, support escalations, and the churn that follows a customer whose new phone would not activate. We wrote about what happens when an entitlement server is unreachable precisely because these incidents are expensive and under-modelled.

The second-market tax. Every new market or brand you add is another integration project, not a configuration change. If you plan to grow, price that in for each expansion, because the range of services and device categories you will want to support only grows over time.
‍

The multiplier the model misses

Here is the part that turns a manageable number into an alarming one: the recurring costs do not stay still. They compound with three things at once, and all three are heading up.

They compound with device diversity, because every new handset family adds to the certification queue. They compound with market count, because every jurisdiction adds compliance and residency work. And they compound with service volume, because the entitlement decision rides on the eSIM wave, and that wave is enormous. GSMA Intelligence projects that eSIM will make up roughly 76% of all smartphone connections, about 6.7 billion, by 2030 (GSMA Intelligence). More eSIM means more activations, more transfers, more companion devices, and more entitlement decisions per subscriber than the SIM-card era ever generated.

The cruel detail is that none of this scales down. In a quiet quarter with no launches, you still pay for the lab, the on-call rotation, the reserved capacity, and the specification team. A managed model like Entitlement-Server-as-a-Service turns most of that into a variable that follows usage. In-house, it is a fixed floor you pay to stand still.
‍

A one-page TCO worksheet you can run this afternoon

You do not need a consultant to get an honest number. You need to price each line below across a realistic horizon, three years at minimum and five for a fair picture, and resist the urge to leave the recurring rows blank.

‍

Total the recurring rows across five years before you compare anything to a subscription. That single discipline changes most build-or-buy conclusions, because it is the first time the fixed floor becomes visible. If you would rather not build the model from a blank sheet, our team can run it with you against your actual estate, traffic and roadmap, and pressure-test every recurring row.
‍

What Entitlement-Server-as-a-Service changes about the math

A managed model does not make these costs vanish. Somebody still runs the lab and chases the specification. What changes is who carries them and how they are shaped.

With Entitlement-Server-as-a-Service, the certification lab, the specification upkeep, and the operational floor are shared across the provider’s whole base, so no single operator pays for all of it alone. Your cost becomes operating expense that tracks usage rather than a fixed floor you fund in quiet quarters. The tail risk of failure is backed by a contractual SLA with credits instead of landing entirely on your own team. And the second-market tax largely disappears, because a multi-tenant platform treats a new brand as configuration rather than a build.

This is exactly the shift the market is making. Counterpoint’s 2025 Global Entitlement Server Landscape shows momentum moving away from the license-and-run incumbents and toward agile, as-a-service providers, and the cost structure above is a big part of why.
‍

When the in-house TCO is actually justified

To be fair to the other side, there are operators for whom the numbers genuinely favour building. If you are at tier-one scale, you may have enough volume to amortise a standing platform team and a certification lab across a very large base, which changes the per-decision economics. If entitlement is a true differentiator for you rather than a utility, the control may be worth the carrying cost. And if you already operate a mature entitlement platform, your marginal cost of continuing can be low enough that a rebuild makes no sense.

For everyone else, and that is most operators and effectively all MVNOs and MVNEs, the honest total cost of ownership points the other way. The entitlement layer is a utility you need to be excellent at, not one you need to own the plumbing for. That is the whole promise of Entitlement-Server-as-a-Service: excellence at the layer, without the standing cost of owning it.
‍

The bottom line

The build estimate answers the wrong question. The right question is what the entitlement layer will cost you to run correctly, every quarter, for the next five years, across a growing fleet of devices and markets. Once the recurring rows are filled in, that number is usually large, and usually fixed, and usually the strongest argument for consuming it as Entitlement-Server-as-a-Service instead of owning it.

If you want to run this properly against your own estate, we will help you build the model, recurring rows and all. Book a working session with our team, bring your build estimate, and we will show you where the hidden line items sit. Or if you would rather just see what “someone else carries the floor” looks like in practice, see Entitlement-Server-as-a-Service in action first.
‍

Frequently asked questions

1. How much does it cost to build an entitlement server?
The build itself is a one-time engineering cost, and for a capable team it is far from the largest number in the business case. The costs that dominate an entitlement server’s total cost of ownership are recurring: GSMA TS.43 specification maintenance, a continuous OEM certification lab, 24/7 low-latency operations, and reserved peak capacity. Any estimate that only prices the build understates the real cost by a wide margin.

2. What are the ongoing costs of running a TS.43 entitlement server?
The main recurring costs are specification upkeep as TS.43 advances (it reached v13.0 in early 2026), continuous device certification across new handset generations, round-the-clock operations for a real-time service with tight latency targets, multi-region capacity for launch-day spikes, and ongoing security, fraud and residency compliance. On top of those sit hidden costs like engineering opportunity cost, key-person risk, and the cost of failures.

3. Is a managed entitlement service cheaper than running one in-house?
For most operators, yes, on a total-cost-of-ownership basis. A managed service spreads the certification lab, specification upkeep and operational floor across many operators, converts a fixed cost into usage-based operating expense, and backs failures with an SLA. In-house can be competitive at tier-one scale or where entitlement is a genuine differentiator, but for most MNOs and effectively all MVNOs and MVNEs, the managed model wins on total cost.

‍