The UE initiates the attach procedure by the transmission of an Attach Request (parameters as specified in TS 23.401 including the Attach Type, old LAI and Mobile Station Classmark 2) message to the MME. The Attach Type indicates that the UE requests a combined EPS/IMSI attach and informs the network that the UE is capable and configured to use CS fallback and/or SMS over SGs. If the UE needs SMS service but not CSFB, the UE shall include an "SMS-only" indication in the combined EPS/IMSI Attach Request. See clause 5.6. A UE that only supports NB-IoT (see TS 23.401) may request SMS service but set the Attach Type to EPS attach instead of combined EPS/IMSI attach.

Step 3 to step 16 of the EPS Attach procedure are performed as specified in TS 23.401 with the differences as described below when "SMS in MME" applies:

• If the MME is enabled to use "SMS in MME" and the MME is not registered with an HSS for that UE (i.e. the MME stores no subscriber data for the UE), the MME performs a registration with HSS as described in Annex C, clause C.8.
• If the MME is enabled to use "SMS in MME" and the MME is registered with an HSS for that UE but has no valid SMS subscriber data (i.e. the MME stores subscriber data for the UE but SMS subscriber data have not been requested before or have been removed by the HSS), the MME may perform a re-registration with HSS as described in Annex C, clause C.8 to obtain SMS subscriber data and to provide the HSS with the MME identity to be used for MT-SMS delivery.
• If the HSS supports "SMS in MME", the HSS follows the registration procedures described in Annex C, clause C.8.

If the UE subscribes to the eMLPP (TS 22.067) service in the CS domain or to another CS domain priority scheme (e.g., based on TIA-917 [46] or TR 22.952) and has a priority level that qualifies for CSFB priority call handling, the UE EPS subscription received from HSS contains the MPS CS Priority indication.

If the Attach Request message includes an Attach Type indicating that the UE requests a combined EPS/IMSI attach, or an NB-IoT-only UE requests SMS and the Attach Type indicates EPS attach, the MME allocates a new LAI for the UE as described in clause 5.1A. The MME does not perform any registrations with a VLR, (i.e. it skips steps 4 to 7 and no SGs association is created), if the Network Access Mode information in the subscriber data indicate that the subscription has no CS subscriber data; or if the HSS registered the MME for "SMS in MME" for the UE as described in Annex C, clause C.8; or if local configuration, e.g. on MSISDN/IMSI segment, indicates that MME should not perform registration with a VLR for the UE (e.g. NB-IoT only UE). If the registration with a VLR is required and multiple PLMNs are available for the CS domain, the MME performs selection of the PLMN for CS domain and CS domain operator if the selected CS network is shared network configuration, based on the PLMN ID contained in the current TAI, old LAI and operator selection policies on preferred RAT for CS domain. If the target network is a shared GERAN, the MME shall also take into account the UE capability of support or non-support of GERAN network sharing when selecting the PLMN for the CS domain as specified in TS 23.251. The PLMN selected for CS should be the same that is used for this UE as a target PLMN for PS handovers or for any other mobility procedures related to CSFB. The MME may take any access restrictions provided by the HSS into account, if the network is using separate location areas for GERAN and UTRAN cells. The selected PLMN ID is included in the newly allocated LAI which is sent to MSC/VLR in step 4 and in Attach Accept to the UE. The MME derives a VLR number based on the newly allocated LAI and the TMSI based NRI as provided by the UE or on the newly allocated LAI and an IMSI hash function defined in TS 23.236. The MME starts the location update procedure towards the new MSC/VLR upon receipt of the subscriber data from the HSS in step 2). This operation marks the MS as EPS-attached in the VLR.

The MME sends a Location Update Request (new LAI, IMSI, MME name, Location Update Type, selected CS domain operator) message to the VLR. MME name is a FQDN string. The cases in which the MME includes the selected CS domain operator towards the VLR are specified in TS 23.251.

The VLR creates an association with the MME by storing MME name.

The VLR performs the normal subscription checks for CS and if all checks are successful performs Location Updating procedure in CS domain. For GWCN configuration, the MSC selects the core network operator as specified in TS 23.251.

The VLR responds with Location Update Accept (VLR TMSI) to the MME.

The EPS Attach procedure is completed by performing step 17 to step 26 as specified in TS 23.401. If the UE requested a combined EPS/IMSI Attach, the Attach Accept message includes the parameters as specified in TS 23.401: VLR TMSI and LAI as allocated in step 3 above. The existence of LAI and VLR TMSI indicates successful attach to CS domain. If the UE requests combined EPS/IMSI Attach Request without the "SMS-only" indication, and if the network supports SGs procedures only for SMS or the network decided to provide "SMS in MME" for the UE, the MME shall indicate in the Attach Accept message that the IMSI attach is for "SMS-only". When the network accepts a combined EPS/IMSI attach without limiting to "SMS-only", the network may provide a "CSFB Not Preferred" indication to the UE. If the UE requests combined EPS/IMSI Attach Request with the "SMS-only" indication, and if the network supports SGs procedures only for SMS or if it supports CSFB and SMS over SGs or the network decided to provide "SMS in MME" for the UE, the MME shall indicate in the Attach Accept message that the IMSI attach is for "SMS-only". If the MME provides "SMS in MME" for a UE that requested combined EPS/IMSI Attach, then the TMSI and LAI are provided as specified in clause C.4.2. The network provides the "SMS-only" or "CSFB Not Preferred" indications based on locally configured operator policies based on e.g. roaming agreement. The UE behaviour upon receiving such indications is described in TS 23.221. If the PLMN ID for the CS domain (included in the LAI provided to the UE) differs from the PLMN ID provided as part of the GUTI, the equivalent PLMNs list includes the PLMN ID for the CS domain.

If the VLR has updated the SGs association and if a paging timer is still running for a MT service for this UE, the VLR shall repeat SGs Paging Request towards the updated SGs association.