A mobile device has a cellular network modem and a memory to store pre-activation credentials and permanent credentials. A processor is configured to, in an ambient access mode that uses the pre-activation credentials, provide network access control according to a pre-activation service policy that controls access to a first carrier access network. In this mode, an allowed network service activity is an activation sequence that connects the device to an Internet-connected activation server through the first carrier access network. The activation sequence presents carrier selections obtained from the activation server to a user, allows the user to select one of several carriers, and then negotiates with the activation server to obtain permanent credentials for the selected carrier.