5GMM States in 5G NAS
5GMM states describe where the UE sits in mobility-side NAS control. They help explain whether the UE is currently outside normal mobility service, already known to the core, or moving through a temporary registration, update, service, or deregistration branch.
Use this page when a 5GMM message or cause does not make sense until you first place the UE in the correct mobility-side state.
Quick facts
| Technology | 5G |
|---|---|
| Area / Protocol | 5GMM states in NAS |
| Main use | Show where the UE sits in mobility-side NAS progression and which messages make sense next |
| UE main states | 5GMM-NULL, 5GMM-DEREGISTERED, 5GMM-DEREGISTERED-INITIATED, 5GMM-REGISTERED-INITIATED, 5GMM-REGISTERED, 5GMM-SERVICE-REQUEST-INITIATED |
| Network main states | 5GMM-DEREGISTERED, 5GMM-DEREGISTERED-INITIATED, 5GMM-COMMON-PROCEDURE-INITIATED, 5GMM-REGISTERED |
| Related topics | Registration, service request, authentication, deregistration, 5GMM cause values |
Contents
Overview
The 5GMM state model is a practical way to understand mobility-side procedure meaning. It tells you whether the UE is already registered, not yet registered, or in the middle of a temporary procedure branch that has not completed yet on the N1 interface.
This matters because the same message or cause can mean different things depending on whether the UE is entering service for the first time, returning to service through Service Request, or exiting existing mobility context through deregistration.
UE state flow
The main UE-side 5GMM flow moves between no context, deregistered context, registration in progress, registered context, service request in progress, and deregistration cleanup. The diagram below is a compact reference view of the main UE state progression.
Network state flow
The network-side 5GMM view is more compact. The AMF mainly moves between deregistered context, common procedure handling, registered context, and deregistration cleanup. This view is useful when the question is what the core thinks the UE state is while messages are being processed.
Quick lookup
Use the quick lookup table for fast state matching, then move into the UE or network state sections when you need the more detailed meaning behind a state transition or a stalled procedure branch. When the state is already known but the failure reason is not, the next step is usually 5GMM cause values.
| State | Side | Typical meaning | Typical procedures |
|---|---|---|---|
| 5GMM-NULL | UE | Initial UE-side condition after power-on or reset, before 5GS mobility management is active. | Early startup handling before selection and registration logic really begins. |
| 5GMM-DEREGISTERED | UE | The UE is not registered to a 5G network and does not hold usable 5GMM context. | Initial registration, identity recovery, limited service handling, PLMN search, or re-entry after rejection. |
| 5GMM-DEREGISTERED-INITIATED | UE | The UE has started deregistration but the mobility-side cleanup is not complete yet. | Deregistration request and accept exchange, cleanup of registration context, and transition toward deregistered baseline. |
| 5GMM-REGISTERED-INITIATED | UE | The UE has started registration and is waiting for the network to complete or reject the process. | Initial registration, mobility update style registration, periodic update, and emergency or restricted registration variants. |
| 5GMM-REGISTERED | UE | The UE is successfully known to the network on the mobility side and holds valid 5GMM registration context. | Service request, periodic registration update, mobility registration update, paging response, and later common procedures. |
| 5GMM-SERVICE-REQUEST-INITIATED | UE | The UE has initiated service return and is waiting for the network to grant or reject the request. | UE-triggered or network-triggered service request handling, paging-driven return, and service rejection branches. |
| 5GMM-DEREGISTERED.NORMAL-SERVICE | UE sub-state | The UE is deregistered but can perform normal search and registration behavior. | 5GMM-DEREGISTERED |
| 5GMM-DEREGISTERED.LIMITED-SERVICE | UE sub-state | The UE has only limited access, typically for emergency or restricted service conditions. | 5GMM-DEREGISTERED |
| 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION | UE sub-state | The UE is trying to register but has not completed registration yet. | 5GMM-DEREGISTERED |
| 5GMM-DEREGISTERED.PLMN-SEARCH | UE sub-state | The UE is searching for a suitable PLMN to register with. | 5GMM-DEREGISTERED |
| 5GMM-DEREGISTERED.NO-SUPI | UE sub-state | The UE does not have a usable SUPI for registration. | 5GMM-DEREGISTERED |
| 5GMM-DEREGISTERED.NO-CELL-AVAILABLE | UE sub-state | The UE cannot find a suitable cell for registration or is out of coverage. | 5GMM-DEREGISTERED |
| 5GMM-DEREGISTERED.eCALL-INACTIVE | UE sub-state | The UE is deregistered and not actively searching, with eCall inactive. | 5GMM-DEREGISTERED |
| 5GMM-DEREGISTERED.INITIAL-REGISTRATION-NEEDED | UE sub-state | The UE needs to perform initial registration before normal service can continue. | 5GMM-DEREGISTERED |
| 5GMM-REGISTERED.NORMAL-SERVICE | UE sub-state | The UE is registered and has normal access to service. | 5GMM-REGISTERED |
| 5GMM-REGISTERED.NON-ALLOWED-SERVICE | UE sub-state | The UE is registered but specific services are not allowed. | 5GMM-REGISTERED |
| 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE | UE sub-state | The UE is trying to update existing registration context. | 5GMM-REGISTERED |
| 5GMM-REGISTERED.LIMITED-SERVICE | UE sub-state | The UE remains registered but only limited service is available. | 5GMM-REGISTERED |
| 5GMM-REGISTERED.PLMN-SEARCH | UE sub-state | The UE is registered but is searching for another PLMN. | 5GMM-REGISTERED |
| 5GMM-REGISTERED.NO-CELL-AVAILABLE | UE sub-state | The UE is registered but currently has no usable cell. | 5GMM-REGISTERED |
| 5GMM-REGISTERED.UPDATE-NEEDED | UE sub-state | The UE must update registration information before normal continuity can continue cleanly. | 5GMM-REGISTERED |
| 5GMM-DEREGISTERED | Network | The network-side mobility view does not currently provide normal service context for the UE. | Registration attempts, early paging-related awareness, and readiness to accept new mobility entry. |
| 5GMM-DEREGISTERED-INITIATED | Network | The network is processing deregistration and releasing UE context. | Deregistration processing, context release, and completion acknowledgement. |
| 5GMM-COMMON-PROCEDURE-INITIATED | Network | The network is handling a common 5GMM procedure such as registration, service request, paging, or another mobility-side branch. | Registration processing, service request handling, paging, identity, authentication, security mode control, and related common procedures. |
| 5GMM-REGISTERED | Network | The network holds active registered mobility context for the UE and can provide normal services. | Paging, service request, periodic registration update, mobility handling, policy enforcement, and later common procedures. |
UE main states
The UE-side 5GMM model has two useful layers: main states and sub-states. The main states show whether the UE has no mobility context, is deregistered, is registered, or is in a temporary mobility-side procedure branch such as initial registration, service request, or deregistration.
5GMM-NULL
Initial UE-side condition after power-on or reset, before 5GS mobility management is active.
Entered when: UE power-on, reset, or very early startup before usable 5GS mobility context exists.
What it means: 5GS services are disabled, no 5GMM procedure is running, and the UE is not reachable for mobile-terminated 5GS services.
Typical procedures: Early startup handling before selection and registration logic really begins.
Trace note: This is the cleanest no-context state. It is less visible in everyday trace work than deregistered and registered, but it matters as the baseline before any 5GMM context is established.
5GMM-DEREGISTERED
The UE is not registered to a 5G network and does not hold usable 5GMM context.
Entered when: After power-up selection, after deregistration completion, after context loss, or after failures that force a fresh entry path.
What it means: The UE is not reachable for normal mobile-terminated service and must perform initial or recovery-style registration to establish context.
Typical procedures: Initial registration, identity recovery, limited service handling, PLMN search, or re-entry after rejection.
Trace note: This is the main starting point for registration analysis. When a trace begins with Registration Request, this is usually the effective mobility-side state behind it.
5GMM-DEREGISTERED-INITIATED
The UE has started deregistration but the mobility-side cleanup is not complete yet.
Entered when: UE-originated or network-triggered deregistration after the request side has started the release of mobility context.
What it means: The UE is in a temporary cleanup branch where deregistration signaling is in progress and final state settlement is still pending.
Typical procedures: Deregistration request and accept exchange, cleanup of registration context, and transition toward deregistered baseline.
Trace note: If a trace seems stuck between registered and deregistered behavior, this temporary state is often the missing explanation.
5GMM-REGISTERED-INITIATED
The UE has started registration and is waiting for the network to complete or reject the process.
Entered when: After Registration Request when registration has started but has not yet settled into registered context.
What it means: The UE is mid-registration and the next important branches are identity, authentication, security, and registration completion.
Typical procedures: Initial registration, mobility update style registration, periodic update, and emergency or restricted registration variants.
Trace note: This is the main temporary state for reading registration progression. A reject here means the UE never settled into registered baseline.
5GMM-REGISTERED
The UE is successfully known to the network on the mobility side and holds valid 5GMM registration context.
Entered when: After successful registration acceptance and completion of the key mobility-side setup steps.
What it means: The UE can be paged, can request service return, and can continue with updates, configuration changes, and later mobility-side procedures.
Typical procedures: Service request, periodic registration update, mobility registration update, paging response, and later common procedures.
Trace note: This is the most important steady state for normal service continuity. Many later failures make sense only after first confirming that the UE was already registered.
5GMM-SERVICE-REQUEST-INITIATED
The UE has initiated service return and is waiting for the network to grant or reject the request.
Entered when: When a registered UE starts service request to restore active access to signaling or user-plane service.
What it means: Stored mobility context already exists, but active service restoration is still in progress.
Typical procedures: UE-triggered or network-triggered service request handling, paging-driven return, and service rejection branches.
Trace note: This state is the key bridge between being registered in principle and becoming active again in practice.
UE sub-states
The UE also carries more detailed sub-states under the main deregistered and registered positions. These are useful when a trace is not just asking whether the UE is registered, but what kind of registered or deregistered condition it is currently in.
| UE sub-state | Parent state | Main meaning | Detailed description |
|---|---|---|---|
| 5GMM-DEREGISTERED.NORMAL-SERVICE | 5GMM-DEREGISTERED | The UE is deregistered but can perform normal search and registration behavior. | Use this as the normal deregistered baseline when the UE is expected to find service and start registration without special restrictions. |
| 5GMM-DEREGISTERED.LIMITED-SERVICE | 5GMM-DEREGISTERED | The UE has only limited access, typically for emergency or restricted service conditions. | This matters when the UE can see access but not use full normal service. |
| 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION | 5GMM-DEREGISTERED | The UE is trying to register but has not completed registration yet. | This is useful when the UE is repeatedly trying to enter service from a deregistered baseline. |
| 5GMM-DEREGISTERED.PLMN-SEARCH | 5GMM-DEREGISTERED | The UE is searching for a suitable PLMN to register with. | This helps explain why registration does not start immediately even though the UE is powered and searching. |
| 5GMM-DEREGISTERED.NO-SUPI | 5GMM-DEREGISTERED | The UE does not have a usable SUPI for registration. | This is an identity-availability problem before normal registration can proceed. |
| 5GMM-DEREGISTERED.NO-CELL-AVAILABLE | 5GMM-DEREGISTERED | The UE cannot find a suitable cell for registration or is out of coverage. | This explains why NAS registration does not move forward even though the UE remains in a deregistered baseline. |
| 5GMM-DEREGISTERED.eCALL-INACTIVE | 5GMM-DEREGISTERED | The UE is deregistered and not actively searching, with eCall inactive. | This is a special restricted branch rather than a normal service-seeking baseline. |
| 5GMM-DEREGISTERED.INITIAL-REGISTRATION-NEEDED | 5GMM-DEREGISTERED | The UE needs to perform initial registration before normal service can continue. | This is one of the most practical sub-states because it explains why update-style reuse is not enough and full initial registration is required. |
| 5GMM-REGISTERED.NORMAL-SERVICE | 5GMM-REGISTERED | The UE is registered and has normal access to service. | This is the normal steady-state registered condition for everyday trace reading. |
| 5GMM-REGISTERED.NON-ALLOWED-SERVICE | 5GMM-REGISTERED | The UE is registered but specific services are not allowed. | This helps explain why mobility context exists but the wanted service still cannot proceed normally. |
| 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE | 5GMM-REGISTERED | The UE is trying to update existing registration context. | This is important for mobility or periodic update analysis when the UE is already registered but needs state refresh. |
| 5GMM-REGISTERED.LIMITED-SERVICE | 5GMM-REGISTERED | The UE remains registered but only limited service is available. | This is a restricted registered condition rather than a full-service one. |
| 5GMM-REGISTERED.PLMN-SEARCH | 5GMM-REGISTERED | The UE is registered but is searching for another PLMN. | This matters during roaming, mobility, or loss-of-service transitions while registration context still exists. |
| 5GMM-REGISTERED.NO-CELL-AVAILABLE | 5GMM-REGISTERED | The UE is registered but currently has no usable cell. | This is a common explanation when registration context exists but access-side continuity is broken. |
| 5GMM-REGISTERED.UPDATE-NEEDED | 5GMM-REGISTERED | The UE must update registration information before normal continuity can continue cleanly. | This is a practical signal that stored context exists but is no longer fully current. |
Network states
The network-side 5GMM view is different from the UE-side view. It tells you whether the AMF currently treats the UE as registered, deregistered, under common-procedure processing, or in the middle of deregistration cleanup. It is especially useful when reading Registration Request, Registration Accept, Service Request, and Deregistration Request from the network perspective.
5GMM-DEREGISTERED
The network-side mobility view does not currently provide normal service context for the UE.
Entered when: Before successful registration or after deregistration/context release.
What it means: The network can still watch for registration attempts and be ready to process them, but usable registered mobility context is not active.
Typical procedures: Registration attempts, early paging-related awareness, and readiness to accept new mobility entry.
Trace note: This is the network-side baseline when the UE is not in an active registered mobility position from the AMF point of view.
5GMM-DEREGISTERED-INITIATED
The network is processing deregistration and releasing UE context.
Entered when: After deregistration has started but before full cleanup and final state settlement.
What it means: The AMF is updating context, releasing resources, and steering the UE toward completed deregistration handling.
Typical procedures: Deregistration processing, context release, and completion acknowledgement.
Trace note: This is the network-side cleanup branch that explains why the UE may still be visible in context teardown while no longer fully registered.
5GMM-COMMON-PROCEDURE-INITIATED
The network is handling a common 5GMM procedure such as registration, service request, paging, or another mobility-side branch.
Entered when: When the AMF is actively processing one or more common procedures instead of resting in a steady registered or deregistered baseline.
What it means: The network is managing UE mobility context, allocation, validation, and abnormal handling during active procedure processing.
Typical procedures: Registration processing, service request handling, paging, identity, authentication, security mode control, and related common procedures.
Trace note: This is the most useful network-side temporary state because many message sequences sit here while the AMF is deciding whether to accept, reject, or continue a mobility-side procedure.
5GMM-REGISTERED
The network holds active registered mobility context for the UE and can provide normal services.
Entered when: After successful registration and establishment of usable mobility context.
What it means: The AMF can manage mobility, service return, paging, updates, restrictions, and later common procedures using stored UE context.
Typical procedures: Paging, service request, periodic registration update, mobility handling, policy enforcement, and later common procedures.
Trace note: This is the network-side steady state behind normal service continuity and mobile-terminated reachability.
Why states matter
Before deciding what a 5GMM message means, ask four questions:
1. Is the state being read from the UE side or the network side?
2. Is the UE registered or deregistered in the current mobility view?
3. Is a mobility-side common procedure already in progress?
4. Does the next message fit that state?
This is often the fastest way to spot state mismatch. A service-side message in the wrong mobility context, a new registration attempt while deregistration cleanup is still unresolved, or a reject that only makes sense in a temporary initiated branch usually becomes clearer here first. If the state path stalls around identity, authentication, or security setup, the next page is usually authentication, security mode, and initial NAS protection.
Example
A simple example is a UE moving from 5GMM-DEREGISTERED into registration by sending Registration Request.
Start with the UE in a deregistered mobility-side position.
Registration Request starts the move toward registered context.
Authentication and security progression happen while registration is still being resolved.
Registration Accept is the point where the state settles into registered context.
FAQ
What are 5GMM states?
They are the mobility-side NAS state positions that explain where the UE is in registration, service, update, or deregistration progression.
Why are 5GMM states useful?
They help explain why a message is valid, invalid, accepted, rejected, or out of sequence in a mobility-side trace.
Do 5GMM states replace cause values?
No. States explain position, while causes explain why the procedure could not continue or was rejected.
References
- 3GPP TS 24.501, Non-Access-Stratum (NAS) protocol for the 5G System
- 3GPP TS 23.502, Procedures for the 5G System
- ShareTechnote 5GMM statemachine: UE-side view
- ShareTechnote 5GMM statemachine: network-side view