Various embodiments are described for authenticating a wireless device (101) and/or an associated user subscription. By using a single authentication exchange with the wireless device to obtain a device credential, a connectivity service network (CSN) (231) authenticates and validates the device credential to establish a device identity. For device-identity-based subscription, the device identity may be used to validate a subscription. For user subscription authentication, a second authentication exchange is performed using the encrypted connection established by the first authentication exchange (a.k.a, the outer exchange). By utilizing only one outer authentication exchange, embodiments are made possible that exhibit reduced messaging and lower complexity when compared to known techniques.