We consider time-of-arrival (ToA) estimation of a first arrival-path for a device working in narrowband Internet-of-Things (NB-IoT) systems. Due to a limited 180 KHz bandwidth used in NB-IoT, the time-domain auto-correlation function (ACF) of transmitted NB positioning reference signal (NPRS) has a wide main lobe. Without considering that, the performance of ToA estimation can be degraded for two reasons. Firstly, under multiple-path channel environments, the NPRS corresponding to different received paths are superimposed on each other, and so are the cross-correlations corresponding to them. Secondly, the measured peak-to-average-power-ratio (PAPR) used for detecting the presence of NPRS is inaccurate. Therefore, in this paper we propose a space-alternating generalized expectation-maximization (SAGE) based method to jointly estimate the number of channel taps, the channel coefficients and the corresponding delays in NB-IoT systems, with considering the imperfect ACF of NPRS. Such a proposed method only uses the time-domain cross-correlations between the received signal and the transmitted NPRS, and has a low complexity. We show through simulations that, the ToA estimation of the proposed method performs close to the maximum likelihood (ML) estimation for a single-path channel, and significantly outperforms a traditional ToA estimator that uses signal-to-noise (SNR) or power thresholds based estimation.