How to connect Surface Pro to 5G SA Private network (PLMN 999xx)?

Question

How to connect Surface Pro to 5G SA Private network (PLMN 999xx)?

John Fornehed 30

I'm trying to connect a Surface Pro to a 5G network. (Microsoft Surface Pro 11 5G X1P-64-100 16/256 13" W11P PLA)
The network is a 5G SA (stand alone) and it is a private network (plmn=999xx)

The surface pro doesn't even try to attach.

The Surface pro connects well to public 5G networks

Answer accepted by question author

3 additional answers

Your answer

Answer 1

Ian-Ng 10,515 Microsoft External Staff Moderator

Hi @John Fornehed,

Welcome to Microsoft Q&A forum.

Thank you for reaching out regarding the connectivity issue with the Surface Pro 11 on the Private 5G SA network (PLMN 999xx).

The behavior you are observing, where the device does not attempt to attach to the network, is intended behavior for standard Windows 11 configurations.

Standard devices are configured to ignore private '999xx' networks by default. This is a safety filter to prevent regular users from accidentally connecting to restricted maintenance channels. Even though the hardware detects the signal, the software automatically hides it to avoid connection errors.

Regarding the solution, to enable connectivity for a Private 5G network, we must move beyond the consumer settings and apply an Enterprise Provisioning Package (.ppkg). This is the standard Microsoft method for authorizing specific PLMNs and defining the correct "Attach APN" for private infrastructure.

Steps to resolve:

Download Tool: Install the Windows Configuration Designer (available from the Microsoft Store) on a PC.
Create Profile: Select Advanced Provisioning and navigate to: Runtime Settings > Connections > EnterpriseAPN
Configure Parameters: Enter the specific details for your private core.
- Connection Name: (e.g., Private5G)
- MCC: 999
- MNC: (Enter your specific 2 or 3 digit MNC, e.g., 01)
- ApnName: (Enter the exact APN required by your core)
- IsAttachAPN: Set to True (Critical: This forces the modem to use this APN for the initial handshake).
- IpType: IPv4v6
Deploy: Export the .ppkg file, double-click it on the target Surface Pro to install, and reboot the device.

Note on SIM card: please also verify that your SIM profile has the PLMN 999xx listed in the EHPLMN (Equivalent Home PLMN) file. If the SIM treats 999xx as a roaming network, the modem may still hesitate to connect depending on the roaming policy set in the provisioning package.

I hope this information is helpful. Please follow these steps and let me know if it works for you. Looking forward to your response.

John Fornehed 30 Reputation points

2026-01-22T20:33:09.3333333+00:00

Yey!! I'll try tomorrow . Thank you so much :-)
John Fornehed 30 Reputation points

2026-01-23T08:32:08.6833333+00:00

Thank y

Thank you! Unfortunately I found no place to add MCC/MNC
John Fornehed 30 Reputation points

2026-01-23T13:03:52.0366667+00:00

Some LLM proposed I should use Windows Enterprise version. Except that I ran out of ideas. Couldn't even figure out how to access AT-Commands
Ian-Ng 10,515 Reputation points Microsoft External Staff Moderator

2026-01-23T22:15:03.7433333+00:00
Hi @John Fornehed,

Thank you for your response. The reason you cannot find the MCC/MNC fields in the Windows Configuration Designer is not because you have the wrong Windows version, but because the provisioning method for Windows 11 has evolved.

In modern Windows provisioning (CSP), it no longer binds the settings to the Network Tower (MCC/MNC); instead, it binds them to the specific SIM Card (ICCID).

Here is the exact fix based on the screenshot you provided:

1/Use the IccId FieldLook at your screenshot again, specifically the 6th row down labeled IccId.

You need to enter the ICCID (SIM ID) of the SIM card currently inside your Surface Pro into this field.

Open Command Prompt (cmd) on the Surface and type: netsh mbn show interface. Copy the "Sim Id" string and paste it into the IccId field in the Designer.

This tells Windows: "When you see THIS specific SIM card, force these specific Attach settings." This bypasses the need for the OS to filter by network ID.

2/ Some important settings check

In your screenshot, ensure these specific values are set:

IsAttachAPN: True (You already have this set correctly. This is the "magic switch" that forces the modem to use your private APN for the initial handshake).

Roaming: Change this to Allowed. (Since your private network 999xx does not match the country code of a standard SIM, the modem will view it as "roaming." You must explicitly allow this).

IPType: Ensure this is IPv4v6 (Private 5G cores often reject IPv4-only requests).

3/ Clarification on "Windows Enterprise" and AT commands

Actually, you do not need Windows Enterprise, the tool you are using works perfectly on Windows 11 Pro. The advice you received elsewhere was incorrect.

Please stop trying to access AT Commands, on Surface Pro 11 (Snapdragon X platform), the modem ports are locked down by the OS for security and stability. You cannot access them without engineering tools, and you do not need them for this configuration.

Below is the summary of next steps:

Get the ICCID from the device (netsh mbn show interface).

Paste it into the IccId field in your project.

Set Roaming to Allowed.

Export the package (.ppkg) and install it on the Surface.

Reboot.

Could you please give it a try and update me on the response?

Truly appreciate your patience. Thank you.
John Fornehed 30 Reputation points

2026-01-25T12:29:38.51+00:00

Thank you! I made and installed a profile. No success. Some other UEs require a "NR only" settings but I don't see that on the Surface Pro. That would force the device not relying on a 4G/LTE network. My network is 5G only and has no 4G core. What I'm doing wrong? Has this ever been tested by anyone?

Some commands with its print below
C:\Windows\System32>netsh mbn show profile name="BC672268-B3DE-4C58-9FD0-5E26292FA2BB"

Profile BC672268-B3DE-4C58-9FD0-5E26292FA2BB on interface Cellular:

=======================================================================

Profile Information

-------------------

Version : 2

Type : Mobile Broadband

Name :

Default : Yes

Additional PDP Context : No

Tethering : No

Control options :

Connection mode : Auto connect always

Connectivity settings

---------------------

Service Provider Name :

Access Point Name : (null)

Username : (null)

Preferred Roaming Providers : (null)

Cost settings

-------------

Cost : Unrestricted

Congested : No

Approaching Data Limit : No

Over Data Limit : No

Roaming : No

Cost Source : User

C:\Windows\System32>netsh mbn show profiles interface="Cellular"

Profiles on interface Cellular:

C:\Windows\System32>netsh mbn show interfaces

There is 1 interface on the system:

Name : Cellular

Description : Surface 5G Mobile Broadband

GUID

Physical Address :

Additional PDP Context : No (Physical interface)

Parent Interface Guid : No parent

State : Not connected

Device type : Mobile Broadband device is embedded in the system

Cellular class : GSM

Device Id :

Manufacturer : Surface

Model : Surface 5G Mobile Broadband

Firmware Version : 250305-DE-5559f99-00197

Provider Name :

Roaming : Not roaming

Signal : 0%

RSSI / RSCP : 0 (-113 dBm)
John Fornehed 30 Reputation points

2026-01-25T12:42:26.9433333+00:00

Unfortunately no success here. Has this been tested by anyone. Other UEs have a "NR only" switch but I don't see it on the Surface Pro. My profile pasted below and some commands.

C:\Windows\System32>netsh mbn show profile name="BC672268-B3DE-4C58-9FD0-5E26292FA2BB"

Profile BC672268-B3DE-4C58-9FD0-5E26292FA2BB on interface Cellular:

=======================================================================

Profile Information

-------------------

Version : 2

Type : Mobile Broadband

Name : BC672268-B3DE-4C58-9FD0-5E26292FA2BB

Default : Yes

Additional PDP Context : No

Tethering : No

Control options :

Connection mode : Auto connect always

Connectivity settings

---------------------

Service Provider Name :

Access Point Name : (null)

Username : (null)

Preferred Roaming Providers : (null)

Cost settings

-------------

Cost : Unrestricted

Congested : No

Approaching Data Limit : No

Over Data Limit : No

Roaming : No

Cost Source : User

C:\Windows\System32>netsh mbn show profiles interface="Cellular"

Profiles on interface Cellular:

-------------------------------------

{BF522D42-71FB-4941-88F2-41CF50171378}

BC672268-B3DE-4C58-9FD0-5E26292FA2BB

C:\Windows\System32>netsh mbn show interfaces

There is 1 interface on the system:

Name : Cellular

Description : Surface 5G Mobile Broadband

GUID : {1E2AA350-EEA6-4AC4-A320-C40617C82A86}

Physical Address : 00:a0:c6:00:00:01

Additional PDP Context : No (Physical interface)

Parent Interface Guid : No parent

State : Not connected

Device type : Mobile Broadband device is embedded in the system

Cellular class : GSM

Device Id : 350788131442952

Manufacturer : Surface

Model : Surface 5G Mobile Broadband

Firmware Version : 250305-DE-5559f99-00197

Provider Name :

Roaming : Not roaming

Signal : 0%

RSSI / RSCP : 0 (-113 dBm)

John Fornehed 30

C:\Windows\System32>netsh mbn show profile name="BC672268-B3DE-4C58-9FD0-5E26292FA2BB"

Profile BC672268-B3DE-4C58-9FD0-5E26292FA2BB on interface Cellular:

=======================================================================

Profile Information

Version                : 2

Type                   : Mobile Broadband

Name                   : BC672268-B3DE-4C58-9FD0-5E26292FA2BB

Default                : Yes

Additional PDP Context : No

Tethering              : No

Control options        :

    Connection mode    : Auto connect always

Connectivity settings

Service Provider Name  :

Access Point Name      : (null)

Username               : (null)

Preferred Roaming Providers : (null)

Cost settings

Cost                   : Unrestricted

Congested              : No

Approaching Data Limit : No

Over Data Limit        : No

Roaming                : No

Cost Source            : User

C:\Windows\System32>netsh mbn show profiles interface="Cellular"

Profiles on interface Cellular:

{BF522D42-71FB-4941-88F2-41CF50171378}

BC672268-B3DE-4C58-9FD0-5E26292FA2BB

C:\Windows\System32>netsh mbn show interfaces

There is 1 interface on the system:

Name                   : Cellular

Description            : Surface 5G Mobile Broadband

GUID                   : {1E2AA350-EEA6-4AC4-A320-C40617C82A86}

Physical Address       : 00:a0:c6:00:00:01

Additional PDP Context : No (Physical interface)

Parent Interface Guid  : No parent

State                  : Not connected

Device type            : Mobile Broadband device is embedded in the system

Cellular class         : GSM

Device Id              : 350788131442952

Manufacturer           : Surface

Model                  : Surface 5G Mobile Broadband

Firmware Version       : 250305-DE-5559f99-00197

Provider Name          :

Roaming                : Not roaming

Signal                 : 0%

RSSI / RSCP            : 0 (-113 dBm)

John Fornehed 30

Still no success unfortunately. Is this ever tested by anyone? Ather UEs have a "NR only" switch for networks with no 4G/LTE core. Didn't find that on Surface Pro.

Some commands below:

C:\Windows\System32>netsh mbn show profile name="BC672268-B3DE-4C58-9FD0-5E26292FA2BB"

Profile BC672268-B3DE-4C58-9FD0-5E26292FA2BB on interface Cellular:

=======================================================================

Profile Information

Version                : 2

Type                   : Mobile Broadband

Name                   : BC672268-B3DE-4C58-9FD0-5E26292FA2BB

Default                : Yes

Additional PDP Context : No

Tethering              : No

Control options        :

    Connection mode    : Auto connect always

Connectivity settings

Service Provider Name  :

Access Point Name      : (null)

Username               : (null)

Preferred Roaming Providers : (null)

Cost settings

Cost                   : Unrestricted

Congested              : No

Approaching Data Limit : No

Over Data Limit        : No

Roaming                : No

Cost Source            : User

C:\Windows\System32>netsh mbn show profiles interface="Cellular"

Profiles on interface Cellular:

{BF522D42-71FB-4941-88F2-41CF50171378}

BC672268-B3DE-4C58-9FD0-5E26292FA2BB

C:\Windows\System32>netsh mbn show interfaces

There is 1 interface on the system:

Name                   : Cellular

Description            : Surface 5G Mobile Broadband

GUID                   : {1E2AA350-EEA6-4AC4-A320-C40617C82A86}

Physical Address       : 00:a0:c6:00:00:01

Additional PDP Context : No (Physical interface)

Parent Interface Guid  : No parent

State                  : Not connected

Device type            : Mobile Broadband device is embedded in the system

Cellular class         : GSM

Device Id              : 350788131442952

Manufacturer           : Surface

Model                  : Surface 5G Mobile Broadband

Firmware Version       : 250305-DE-5559f99-00197

Provider Name          :

Roaming                : Not roaming

Signal                 : 0%

RSSI / RSCP            : 0 (-113 dBm)

John Fornehed 30

C:\Windows\System32>netsh mbn show profile name="BC672268-B3DE-4C58-9FD0-5E26292FA2BB"

Profile BC672268-B3DE-4C58-9FD0-5E26292FA2BB on interface Cellular:

=======================================================================

Profile Information

Version                : 2

Type                   : Mobile Broadband

Name                   : BC672268-B3DE-4C58-9FD0-5E26292FA2BB

Default                : Yes

Additional PDP Context : No

Tethering              : No

Control options        :

    Connection mode    : Auto connect always
```Connectivity settings

---------------------

```haskell
Service Provider Name  :

Access Point Name      : (null)

Username               : (null)

Preferred Roaming Providers : (null)
```Cost settings

-------------

```haskell
Cost                   : Unrestricted

Congested              : No

Approaching Data Limit : No

Over Data Limit        : No

Roaming                : No

Cost Source            : User
```C:\Windows\System32>netsh mbn show profiles interface="Cellular"

Profiles on interface Cellular:

-------------------------------------

```sql
{BF522D42-71FB-4941-88F2-41CF50171378}

BC672268-B3DE-4C58-9FD0-5E26292FA2BB
```C:\Windows\System32>netsh mbn show interfaces

There is 1 interface on the system:

```vba
Name                   : Cellular

Description            : Surface 5G Mobile Broadband

GUID                   :

Physical Address       : 00:a0:c6:00:00:01

Additional PDP Context : No (Physical interface)

Parent Interface Guid  : No parent

State                  : Not connected

Device type            : Mobile Broadband device is embedded in the system

Cellular class         : GSM

Device Id           

Manufacturer           : Surface

Model                  : Surface 5G Mobile Broadband

Firmware Version       : 250305-DE-5559f99-00197

Provider Name          :

Roaming                : Not roaming

Signal                 : 0%

RSSI / RSCP            : 0 (-113 dBm)

John Fornehed 30 Reputation points

2026-01-25T16:09:52.46+00:00

Could it be COSA related (Blocked)

Answer 2

John Fornehed 30

User's image

Setting network and sim to public network (shielded room) works. We confirmed by this that 999xx networks are blocked in Microsoft Surface Pro 5G. Speed is as expected in our bw settings and tdd pattern

Lejon 10 Reputation points

2026-02-14T08:16:26.45+00:00

This is a great achievement and lot of effort to make a Microsoft surface pro with built in 5G chip work. The only sad thing is that it took more than a week of hard work for two deep tech telco experts to work it out. Mission impossible for a normal enterprise who wants to run this device on their own 5G SA network. This is an example of barriers we in the industry needs to jointly make disappear! So we enable simplicity the fantastic opportunity of 5G SA for all enterprises.
Lejon 10 Reputation points

2026-02-14T08:39:47.7033333+00:00

The achievement is that we know the barrier, but it is still there so it would be fantastic if someone with device control did take some actions ro remove this blocking feature. Just to continue enabling the 5G echo system...

Answer 3

Barb Bowman 80,695 MVP Volunteer Moderator

Something in your posts is triggering the spam filer and deleting your posts. I've undeleted them. I can't tell you if your scenario was ever tested. You might want to open a support ticket with Surface for Business on this issue.

John Fornehed 30 Reputation points

2026-01-25T16:12:42.57+00:00

Thanks Barb! I was a bit surprised getting that message... violation of our Code of Conduct.... Donno how to open a support ticket but will check
Barb Bowman 80,695 Reputation points MVP Volunteer Moderator

2026-01-25T16:31:41.1533333+00:00

https://learn.microsoft.com/en-us/surface/contact-surface-business-education-support might help
John Fornehed 30 Reputation points

2026-01-26T08:50:01.3333333+00:00

Thank you Barb. I filed a ticket [Moderator note: personal info removed]
Barb Bowman 80,695 Reputation points MVP Volunteer Moderator

2026-01-26T13:26:41.8066667+00:00

Please keep us posted ( we can't follow support tickets ). Hopefully, they will have a solution/work around.

Answer 4

Jack Dickenson 0

Hi,

We are using i Private 5G Network in an Industry in Sweden. We have the same problem. Whilst the ad for the Surface cleary states that its compliant with 5G SA, it doesnt work at all on our SA network. Reading above, i see the PLMN 999xx seems to be the issue, which i can confirm.
When i use Apple or Android devices, they work just fine. Is there a reason Microsoft don't work on these PLMNs?

I also find it strange that Microsoft advertises functionality when it is in face not the case. I have spent a lot of time testing and trying to figure out why our network wasn't working when in fact the problem is with the Microsoft product. Doesn't this classify as false marketing?

Ian-Ng 10,515 Reputation points Microsoft External Staff Moderator

2026-02-24T22:55:10.5366667+00:00

Hi @Jack Dickenson,

Thank you for providing those details and for sharing your experience with the Surface on a Private 5G SA network.

While I understand the frustration regarding the connectivity discrepancies between your Surface and other devices, as a forum moderator, I have limited access to internal product specifications or the specific engineering roadmaps regarding PLMN compatibility. Because I cannot confirm the technical limitations or the nature of the advertised functionality in this specific enterprise context, I recommend reaching out to Surface Support for Business.

They have the dedicated tools to investigate why the device is not behaving as expected on your specific network configuration and can provide official clarification on the product's 5G SA capabilities.

You can initiate a support request through the Microsoft Surface Support portal or via your Microsoft 365 Admin Center to get in touch with an engineer who specializes in enterprise hardware deployments.

Thank you for your understanding.
Jack Dickenson 0 Reputation points

2026-02-27T07:27:30.3933333+00:00

Hi Ian-Ng, Thank you for answering my comment.

I do understand what your saying and that you are a Forum moderator. As i have understood it, the gentlemen above has done the exact test you are asking me to contact the Support to do. Therefore there is no need for me to spend more time waiting for answers i already have.

I would like to know what Microsoft is going to do about it unblocking PLMN 999XX. This PLMN is used for private networks in general, not just our specific network. MAybe you could reach out to someone with this knowledge or send me a link/mailadress to someone in which i can contact to move foward with that ?

Thanks again for your answers.

Share via

How to connect Surface Pro to 5G SA Private network (PLMN 999xx)?

3 additional answers

Your answer