LTE EMM Cause #7: EPS Services Not Allowed — Field Diagnosis Guide

LTE EMM cause #7 (“EPS services not allowed”) is one of the most frequently encountered NAS cause codes in LTE drive testing. It appears in Attach Reject, Tracking Area Update (TAU) Reject, and Service Reject messages when the network determines that LTE (EPS) services are not authorized for the USIM initiating the procedure.

The defining characteristic: cause #7 marks the USIM invalid for EPS services until the device is powered off or the SIM is removed. There is no back-off timer, no automatic retry. The UE stops attempting LTE registration entirely.

Technical Reference

UE Behavior After Receiving Cause #7

Per 3GPP TS 24.301 §5.5.1.2.5 (Attach Reject handling), the UE must:

• Set EPS update status to EU3 ROAMING NOT ALLOWED and store this value in non-volatile memory
• Delete stored GUTI, last visited registered TAI, and TAI list from non-volatile memory
• Mark the USIM as invalid for EPS services until the ME is switched off or the SIM is removed
• Enter state EMM-DEREGISTERED — no further LTE registration attempts are initiated
• Not start any back-off timer — this is a subscription-level restriction, not a transient network condition

The same behavior applies when cause #7 is received in a TAU Reject (§5.5.3.2.5) or a Service Reject (§5.6.1.6).

Cause #7 vs cause #8: Cause #8 (“EPS services and non-EPS services not allowed”) additionally marks the USIM invalid for non-EPS services. Cause #7 is EPS-only — the subscriber may still use 2G/3G voice and SMS.

Field Scenarios

USIM not provisioned for LTE. The most common scenario. The SIM was activated for 2G or 3G services only. The subscription profile in the HSS does not include EPS Subscription Data (defined in 3GPP TS 29.272 §7.3.4), or the Access Restriction Data (ARD) IE has the EPS Access bit set to “access restricted.” Every LTE Attach Request receives cause #7 regardless of RF conditions.

Post-migration provisioning error. After an HSS migration or a subscriber data synchronization failure, affected USIMs may lose their EPS subscription flag. The symptom is identical to the previous scenario but affects only the impacted IMSIs — not the cell or the network. This makes it straightforward to differentiate: multiple impacted SIMs on the same cell versus a consistent UE-side failure.

Operator plan downgrade. Operators can update a subscriber’s HSS profile remotely to add EPS access restriction when downgrading from a 4G plan to a 2G/3G plan. The UE receives cause #7 on the next LTE attach attempt with no UI notification to the subscriber.

Test or factory USIM. Test SIMs used in R&D or factory environments are often provisioned with EPS access disabled to prevent unintended LTE registration. These return cause #7 consistently regardless of coverage.

Step-by-Step Field Diagnosis

Step 1 — Identify the NAS message type. In the Layer 3 NAS log, confirm the message: Attach Reject (NAS message type 0x44), TAU Reject (0x4B), or Service Reject (0x4E). An Attach Reject at the very start of the registration procedure confirms the UE never reached the attached state.

Step 2 — Locate the EMM cause IE. In the Attach Reject decode tree, find the EMM cause Information Element (IE type 0x53). Verify the value is 0x07. Confirm no T3346 value IE is present — its presence would indicate cause #22 (congestion) rather than cause #7.

Step 3 — Check subsequent UE behavior. After cause #7, the UE must enter EMM-DEREGISTERED and stop LTE attach attempts. If the UE immediately retries registration, this may indicate a modem firmware non-compliance with TS 24.301 §5.5.1.2.5.

Step 4 — Cross-validate with a known-good SIM. Insert a SIM confirmed to be LTE-provisioned in the same device on the same cell. A successful attach confirms the issue is USIM-side (subscription), not the network configuration.

Step 5 — Escalate to the provisioning system. On the operator side, verify in the HSS that the IMSI’s subscription includes EPS Subscription Data (TS 29.272 §7.3.4) and that the Access Restriction Data IE has the EPS Access bit cleared (bit 0 = 0 means EPS allowed).

Capturing Cause #7 in the Field

Standard Android telephony APIs do not expose NAS OTA messages to applications. Capturing an Attach Reject with EMM cause #7 requires access to the modem’s DIAG interface, which streams raw NAS log packets. Relevant DIAG log codes include 0x713A (LTE NAS EMM plain OTA incoming) and 0xB0EE (NAS state machine events).

With DIAG-level access, the Attach Reject is decoded in a full ASN.1 message tree: the EMM cause IE value 0x07 appears labeled “EPS services not allowed,” alongside the full NAS context — EPS mobile identity, security header, and the RRC downlink information transfer container carrying the NAS PDU.

Correlate the Attach Reject timestamp with RRC signaling (RRCConnectionRelease or transition to RRC_IDLE) to confirm the UE’s return to idle after the rejection.

Related Cause Codes

• Cause #8 — EPS services and non-EPS services not allowed (more severe restriction)
• Cause #14 — EPS services not allowed in this PLMN (PLMN-specific restriction, not subscription-global)
• Cause #7 in 5GS NAS — 5GS services not allowed (TS 24.501 §9.11.3.2, different spec)
• Cause #43 in 5GS NAS — N1 mode not allowed (equivalent in 5G SA context)