In a 5G core network, user location information is not something the core network can discover by itself. The real-time position of a UE comes from the radio access side, especially the gNB serving the user. The gNB sees which cell the UE is using, which tracking area the cell belongs to, and how that radio-side location should be reported upward. This is why ULI, or User Location Information, is an important parameter in 5GC signaling.

ULI is carried in NGAP signaling from the gNB to the AMF. It gives the core network the location reference needed for registration, mobility management, session handling, policy control, service routing and application exposure. In engineering practice, ULI is not a street-level positioning result. It is a network location identity built from radio access identifiers such as TAI and NR CGI. These identifiers allow the 5G core to understand where the UE is at the tracking-area and cell level.

How ULI Reaches The Core

The reporting direction of ULI is from gNB to AMF. The gNB includes the ULI parameter in several N2 messages so that the AMF can obtain the UE’s current network-side location. This is especially important because AMF decisions depend on where the UE is located, which tracking area it belongs to, and whether mobility or registration updates are needed.

Several NGAP messages may carry ULI, including PDU Session Resource Release Response, PDU Session Resource Modify Response, PDU Session Resource Notify, UE Context Release Complete, UE Context Modification Response, RRC Inactive Transition Report, Handover Notify and Path Switch Request. Two messages are particularly important for NAS transport: Initial UE Message and Uplink NAS Transport. Because these messages carry 5G NAS signaling, AMF can obtain real-time UE location information during NAS-related procedures.

This design keeps the location reporting logic close to the radio network. The gNB observes the serving cell and forwards the relevant identifiers through NGAP. The AMF then uses that information as part of the broader mobility and session context.

What NR ULI Contains

ULI is defined with different location information choices. In broad terms, it can include E-UTRA ULI for NSA-related scenarios and NR ULI for SA-related scenarios. In a 5G standalone network, the key focus is NR ULI.

NR ULI is mainly composed of two parts: 5G TAI and NR CGI, also known as NCGI. TAI identifies the tracking area, while NCGI identifies the specific NR cell at a global level. Together, they tell the core network both the tracking-area context and the radio-cell context of the UE.

TAI is built from MCC + MNC + TAC. MCC and MNC identify the PLMN, while TAC identifies the tracking area. This structure allows the network to associate a UE with the correct operator network and tracking area. The tracking area is inherited from the 4G concept but remains important in 5G mobility management.

NCGI is built from the PLMN identity and NCI. The NCI, or NR Cell Identity, is 36 bits long and contains the gNB ID plus Cell ID. Because the gNB ID is variable length, the Cell ID length depends on how many bits are assigned to the gNB ID. For example, if the gNB ID length is 24 bits, the remaining Cell ID length is 12 bits. This relationship is important when engineers interpret cell identity values or calculate NCI and NCGI.

How Areas Relate Together

The relationship between registration area, tracking area, gNB and cell is central to understanding 5G mobility. A cell belongs to only one base station, and a cell also belongs to only one tracking area. A tracking area may contain multiple base stations and multiple cells. A single gNB may also have different cells assigned to different tracking areas, depending on the radio planning model.

The AMF service area is formed by several tracking areas. Within that service range, AMF can assign different UEs different Registration Areas according to policy. A Registration Area may contain one or more tracking areas. This is similar in concept to the TA List used in 4G, but it is applied in the 5G core mobility context.

The point of a Registration Area is to avoid unnecessary signaling while still keeping the UE reachable. If the UE moves inside its assigned Registration Area, it does not need to trigger a mobility registration update every time it changes cell. If the UE moves outside that assigned area, it needs to start an MRU, or Mobility Registration Update, procedure.

A practical example is a user traveling across a metro line. If the AMF has assigned the user a Registration Area containing TA1, and the user moves from a gNB in TA1 to a gNB in TA2, the movement crosses the assigned registration boundary. Even when the AMF remains the same, the UE still needs to perform MRU because the assigned Registration Area has changed.

Where Location Data Goes

Once the AMF receives ULI from the gNB, location information can be used by several 5G core functions. The AMF is the first core function to receive the reported location. From there, location-related information may be shared with the SMF for session management, with the PCF for policy decisions, and with application-facing functions where the network design allows it.

A typical signaling path can be understood as gNB → AMF → SMF → PCF. The PCF may provide policy-related handling for operator-owned application functions, such as P-CSCF in IMS-related scenarios. Another path can expose information through NEF toward third-party application functions when exposure rules and service permissions apply.

ULI-related information may also be involved in user-plane-related service exposure. For example, the SMF can interact with UPF, and UPF may support HTTP header enrichment toward third-party applications in certain service designs. This does not mean every application automatically receives full location data. It means the 5G architecture has defined paths through which network-side user location information can be used by policy, session and application functions.

For SEO and technical reading purposes, the most important takeaway is simple: ULI starts from the gNB, enters the core through AMF, and can then influence mobility, session, policy and service exposure logic. TAI explains the tracking-area position, NCGI explains the NR cell identity, and Registration Area logic determines when the UE must report mobility changes through MRU.

FAQ

Why can’t AMF directly know the UE’s radio location?

AMF is a core network function. It depends on gNB-reported NGAP information because the serving cell and radio-side location are observed by the access network.

Why are Initial UE Message and Uplink NAS Transport important?

They carry NAS signaling from the UE side toward AMF, so ULI included in these N2 messages helps AMF associate NAS procedures with current UE location information.

What happens if gNB ID length changes?

NCI remains 36 bits, so a longer gNB ID leaves fewer bits for Cell ID. A shorter gNB ID leaves more bits for Cell ID.

Can one gNB belong to several tracking areas?

A gNB can have different cells assigned to different tracking areas. The cell is the key planning unit because each cell belongs to one TA.

Why does MRU matter in daily mobility?

MRU keeps the Registration Area accurate when the UE moves outside its assigned area, allowing the network to maintain reachability without excessive updates inside the area.