Azure China — 21Vianet partition vs global Azure
Azure operated by 21Vianet is a separate cloud partition inside Mainland China — not a global region toggle. Product teams need an OSPA rail, China endpoints, catalog gap checks, and ICP adjacency before public go-live.
Microsoft Azure operated by 21Vianet (Azure China) is a physically isolated Azure instance inside Mainland China — not a region you add to a global subscription. Shanghai Blue Cloud Technology (21Vianet) sells and operates it under Chinese regulations. Your product team must clear OSPA contracting, China Entra / endpoints, catalog gap checks, and ICP adjacency before public workloads are real.
What Azure China is for product teams
Hard names your stack decision will use:
- Azure China partition — Microsoft documents Azure operated by 21Vianet as a physically separated instance of cloud services in China, independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. (“21Vianet”). See Microsoft Azure in China — overview.
- Not a global region toggle — Global EA / CSP / PAYG subscriptions do not open China resources. Migration means redeploying workloads, re-creating identity, and re-pointing integrations — not extending an existing resource group across the boundary.
- OSPA contract rail — Enterprise access starts with an Online Service Premium Agreement (OSPA): OSPA Direct with 21Vianet, or OSPA Indirect via an authorized Azure China partner. See the Azure in China checklist and purchase / OSPA concepts.
- Separate control plane — Portal
portal.azure.cn, Entra sign-inlogin.chinacloudapi.cn, ARMmanagement.chinacloudapi.cn, and CLI/SDK environmentAzureChinaCloud— documented in service availability / REST endpoints and the national-cloud authentication overview. - Catalog is not a mirror — Microsoft states Azure in China has a feature parity gap (narrowing). As of 2026-06-27, our parse of the public products-by-region table showed ~89 China product names vs ~191 Global.
- ICP / PSB adjacency for public sites — The official checklist calls out ICP filing / licensing and public security registration for public websites. Cloud purchase alone does not authorize public DNS cutover.
- China-local docs and Marketplace — Adapt global samples for China endpoints; use Azure Docs for China and azure.cn alongside Learn. See the Azure in China developer guide.
Vocabulary first. Next: what must be true before portal work, then the catalog and gap evidence your architecture review needs.
What must be true before Azure China portal work
Missing any of these stops your product team before a stable China reference architecture — often before the first usable China subscription.
| Precondition | Why your process stalls |
|---|---|
| Partition decision — residency / regulator / domestic integration vs “reach China users from global Azure” | Reachability problems need a different path (edge / acceleration); Azure China is the wrong first answer for latency alone |
| OSPA Direct or Indirect path with a signed China service agreement | No global subscription toggle creates a China tenant; contracting precedes usable portal work |
| PRC legal entity or landing-partner rail for Indirect / distributor paths | Official checklist: commercial eligibility for Azure in China expects a legal entity in China |
| Bill of materials checked against China regions | Global Front Door / DevOps / Fabric / Static Web Apps-style designs fail at architecture review when rows are missing |
Identity and endpoint remapping (AzureChinaCloud, China Entra, China Graph) | Global MSAL defaults, B2B/B2C assumptions, and *.azure.com endpoints break silently |
| ICP / public-publish plan for customer-facing endpoints | Without filing, public websites stay blocked or non-compliant after cloud purchase |
| IaC and CI/CD scoped to China | Terraform modules, OIDC trusts, and artifact feeds built for Global refuse China endpoints until rebuilt |
Chinese-language portals, 21Vianet support channels, and filing rails are part of this floor. Product teams usually cannot finish Azure China onboarding from an overseas laptop alone.
From global Azure assumption to China-ready stack
| Stage | Decision / outcome |
|---|---|
| 1. Partition verdict | Confirm the workload must run in Mainland China (residency / regulator / domestic integration) — not “reach China users from global Azure” alone |
| 2. Contract rail | Sign OSPA Direct or OSPA Indirect; open a China subscription under 21Vianet — do not expect global EA inheritance |
| 3. Identity + endpoints | Stand up a China Entra tenant; point CLI/SDK to AzureChinaCloud; use portal.azure.cn and China REST endpoints |
| 4. Catalog trim | Diff required SKUs vs the China regional table and service differences; replace or relocate gaps |
| 5. Deploy baseline | Redeploy compute, data, networking, and pipelines on China regions and China endpoints |
| 6. Filing adjacency | Align domain, DNS, and public publish with ICP / PSB before cutover |
| 7. Operate | Support via 21Vianet; keep Global and China stacks explicitly separate |
Why OSPA, catalog, and ICP failures cascade
No OSPA → no China subscription to architect. Global credentials never see portal.azure.cn resources. Architecture reviews that assume “add China East” waste cycles until the contract rail exists.
Contract without entity / partner path → onboarding never closes. The checklist expects a China legal entity for commercial eligibility. Teams outside Mainland China ops norms stall at distributor selection, OSPA legal review, or real-name verification unless a local company or China landing partner supplies the rail.
Catalog assumed = Global → mid-build redesign. Static Web Apps, Azure Front Door, Traffic Manager, Azure DevOps, Microsoft Fabric, and several Arc extensions are common Global defaults that do not appear (or appear only partially) in China. Discovering that after sprint commitments is an expensive cascade.
Wrong portal / ARM / Entra endpoints → deploy theater. Samples and modules that still call management.azure.com or login.microsoftonline.com never become a China release train until remapped — see the developer guide and CLI cloud environments.
Cloud ready, ICP ignored → public publish blocked. Public websites still need filing and, where applicable, PSB registration. Buying Azure China capacity does not authorize public DNS cutover — see ICP filing and domain/DNS and ICP licence questions.
Confusing residency with reachability → wrong buy. Speeding access for China users to a global Azure footprint is a different problem than running workloads inside Mainland China — see Cloudflare and China.
Catalog snapshot (2026-06-27)
We parsed Microsoft’s Product availability by region on 2026-06-27, comparing Azure Global (all public geographies excluding China and Azure Government) with China (operated by 21Vianet). For a China-filtered view Microsoft also publishes products available by China regions.
| Metric | Azure Global | Azure China |
|---|---|---|
| Product names | ~191 | ~89 |
| Product / SKU combinations | ~516 | ~247 |
| Product names in Global but not in China table | — | ~102 |
Microsoft’s own documentation states a feature parity gap that is narrowing. Product-name counts understate SKU gaps; regional tables alone can miss control-plane services. For sign-off, cross-check the availability table with the Azure China service differences page and target SKUs in your regions.
Regions
China North, China North 2, China North 3, China East, China East 2, and China East 3 appear in the regional table. Regions marked * carry reserved-access restrictions. Pairing, disaster recovery, and ExpressRoute rules follow China-specific guidance — not the global region-pair matrix. Microsoft documents a free ExpressRoute circuit on paired regions China North–China North 2 and China East–China East 2 (cross-pair Premium rules differ) — see service availability — ExpressRoute in China.
Control plane and contract
| Dimension | Azure Global | Azure China |
|---|---|---|
| Operator | Microsoft | 21Vianet (Shanghai Blue Cloud Technology) |
| Portal | portal.azure.com | portal.azure.cn |
| Subscription | Global EA / CSP / PAYG | China subscription under OSPA (direct or indirect) |
| Sign-in / Entra | login.microsoftonline.com | login.chinacloudapi.cn |
| Resource endpoints | *.windows.net, *.azure.com | *.chinacloudapi.cn, *.chinacloudapp.cn |
| CLI / SDK | Default cloud | AzureChinaCloud |
| Cross-cloud ARM | — | No shared plane with global subscriptions |
| Public websites | Standard publish | Typically ICP filing + PSB where applicable |
Migration means redeploying workloads, re-creating identity, and re-pointing integrations — not extending an existing resource group across the boundary.
Obtaining an enterprise account
China access starts with a signed service agreement — not a global subscription toggle. Commercial entry is through OSPA Direct with 21Vianet or OSPA Indirect via an authorized Azure China distributor. Both paths require a contract before a tenant or subscription is usable. See OSPA / purchase concepts.
Path 1 — Microsoft China Azure sales. Large domestic enterprises tend to get the fastest response. The contract may be signed directly with 21Vianet, but Azure China workloads more often flow through Microsoft’s indirect distributor channel rather than a pure direct sale.
Path 2 — Authorized distributor. Select a partner from Microsoft’s Azure China partner guidance in overview / operations and sign using a PRC legal entity. This is the standard route for companies that already have — or are forming — a local operating company.
Working either path without local relationships typically takes at least two months to reach a firm outcome. Some programs stall indefinitely when entity verification, OSPA legal review, or distributor fit never closes.
Landing partner. Teams that lack confidence in either path — or need a predictable timeline — can provision through a landing partner such as Chinaready. Under Chinaready engagement: a standalone China Entra tenant is committed within 35 days; an additional subscription under Chinaready’s existing tenant within 10 days. Start an assessment.
Other onboarding blockers still apply: wrong portal or ARM endpoint, filing tracks that lag cloud purchase, SKUs missing from the China catalog, and support routed through 21Vianet rather than global Azure (support concepts). Customer-facing sites on Mainland China infrastructure still require ICP filing before go-live and PSB filing within 30 days where applicable — see our ICP and PSB guide. Hybrid designs need explicit cross-border network paths; ExpressRoute paired-region rules in China differ from global — see connectivity and interoperability.
High-level differences by service domain
Source: Product availability by region parsed 2026-06-27, cross-checked with Azure China service differences.
| Service domain | Azure China availability | Main differences vs Azure Global |
|---|---|---|
| Core compute | VM, VMSS, Batch, Cloud Services, Dedicated Host, and related services available | Fewer VM series and SKU coverage than Global; some legacy SKUs retiring |
| App hosting | App Service, Functions, API Management available | Static Web Apps not listed in the China regional table; fewer App Service and Functions plan types; no free App Service Managed Certificate (see below) |
| Containers | AKS, ACI, ACR, Container Apps, Kubernetes Fleet Manager available | Azure Red Hat OpenShift and Container Storage not listed; Container Apps Azure Monitor integration not supported in China |
| Storage | Storage, Blob tiers, Files, Disk, Data Lake Gen2, Backup, Data Box available | Elastic SAN, NetApp Files, Storage Mover, Storage Actions, Managed Lustre not listed |
| Databases | SQL DB, SQL MI, MySQL, PostgreSQL, Cosmos DB, Redis available | Cassandra MI, Oracle Database@Azure, and some advanced or industry database services not listed |
| Analytics | Data Factory, Synapse, Databricks, Data Explorer, Stream Analytics available | Microsoft Fabric, Data Share, Data Manager for Energy not listed |
| AI / ML | Azure AI Search, Azure ML, Speech, Vision, Language, Document Intelligence available via Microsoft Foundry / AI services | Azure Health AI and some Foundry / OpenAI capabilities require separate verification; official China difference pages document AI service variants — not full Global parity |
| Integration and messaging | Event Grid, Event Hubs, Service Bus, Logic Apps, SignalR, Web PubSub available | Some SKUs and regions limited |
| Network | VNet, VPN Gateway, ExpressRoute, Private Link, Firewall, App Gateway, WAF, DNS, Virtual WAN available | Azure Front Door, Traffic Manager, Peering Service, Network Security Perimeter not listed; CDN is a China-specific offering |
| Security | Key Vault, Managed HSM, Defender for Cloud, Sentinel covered | Defender TI, Defender for IoT, Defender for DevOps, Customer Lockbox not listed or require separate verification |
| Identity / control plane | China-dedicated portal, login, Graph, and ARM endpoints | Endpoints entirely separate from Global; B2B, B2C, and MSAL have China-specific difference documentation |
| Hybrid cloud / Arc | Arc-enabled servers, Arc-enabled Kubernetes, Azure Local covered | Arc VMware, Arc SCVMM, Arc SQL, AKS on Arc, and many other Arc extensions not listed; multiple extensions unsupported on Arc-enabled Kubernetes |
| DevOps / developer | Base ARM, API, and Marketplace available in China editions | Azure DevOps, Dev Box, Deployment Environments, App Testing, Lab Services not listed |
| Professional / industry | Limited industry and governance capabilities available | Quantum, Maps, VMware Solution, Large Instances, Education, Universal Print not listed |
App Service TLS certificates
On Azure Global, App Service offers a free App Service Managed Certificate: Azure issues, renews, and binds TLS for custom domains on supported plans. Key Vault can store imported certificates and integrate with App Service for rotation and binding.
Azure China App Service documentation does not document an equivalent free managed certificate. Teams typically obtain a certificate from a third-party or internal CA, upload it to App Service, or import into Key Vault and wire the binding through the China portal workflow. Plan certificate procurement, renewal ownership, and filing-aligned domain timing in the same workstream as App Service deployment — not after go-live. (For a side-by-side sovereign-cloud contrast on managed certificates, see AWS China.)
Service availability matrix (Azure Global vs Azure China)
Same source and date as above. Yes = listed in the China regional table; No = not listed; Partial = listed with documented China limitations.
Necessity: product teams cannot sign off a China architecture without per-service verification — the matrix below is the hard-gate view for common stack choices.
| Azure service | Global | Azure China | Notes |
|---|---|---|---|
| Virtual Machines | Yes | Yes | Fewer VM SKUs in China than Global |
| Virtual Machine Scale Sets | Yes | Yes | Available |
| App Service | Yes | Yes | Premium v3 and ASE covered; no free managed certificate |
| Azure Functions | Yes | Yes | Consumption, Dedicated, and Premium plans covered |
| Static Web Apps | Yes | No | Not listed in China regional table |
| API Management | Yes | Yes | Available |
| AKS | Yes | Yes | Available; fewer ecosystem extensions |
| Azure Red Hat OpenShift | Yes | No | Not listed in China regional table |
| Container Registry | Yes | Yes | Available |
| Container Apps | Yes | Partial | Available; Azure Monitor integration not supported |
| Storage Account / Blob | Yes | Yes | Available |
| Azure Files | Yes | Yes | Available |
| Azure NetApp Files | Yes | No | Not listed in China regional table |
| Azure SQL Database | Yes | Yes | Available |
| Azure SQL Managed Instance | Yes | Yes | Available |
| Cosmos DB | Yes | Yes | Available |
| MySQL Flexible Server | Yes | Yes | Available |
| PostgreSQL Flexible Server | Yes | Yes | Available |
| Data Factory | Yes | Yes | Available |
| Synapse Analytics | Yes | Yes | Available |
| Databricks | Yes | Yes | Available |
| Microsoft Fabric | Yes | No | Not listed in China regional table |
| Azure AI Search | Yes | Yes | Available |
| Azure Machine Learning | Yes | Partial | Available; China feature differences documented |
| Key Vault | Yes | Yes | Managed HSM also covered |
| Azure Monitor | Yes | Yes | Application Insights and Log Analytics covered |
| Microsoft Sentinel | Yes | Partial | China availability caveats apply |
| Virtual Network | Yes | Yes | Available |
| Private Link | Yes | Yes | Confirm availability per target service |
| ExpressRoute | Yes | Yes | Paired-region free-circuit rules apply in China |
| Azure Firewall | Yes | Yes | Basic, Standard, and Premium covered |
| Application Gateway / WAF | Yes | Yes | Available |
| Azure Front Door | Yes | No | Not listed in China regional table |
| Traffic Manager | Yes | No | Not listed in China regional table |
| Azure DevOps | Yes | No | Not listed in China regional table |
| Azure Virtual Desktop | Yes | No | Not listed in China regional table |
| Azure VMware Solution | Yes | No | Not listed in China regional table |
| Azure Arc-enabled servers | Yes | Yes | Available |
| Arc-enabled Kubernetes extensions | Yes | Partial | APIM, App Service, Dapr, Event Grid, ML, Defender, and other extensions not supported |
What blocks product teams on Azure China
- Treating China as a global region toggle — subscriptions, Entra tenants, and ARM never span the partition.
- No OSPA / entity rail — commercial eligibility expects a China legal entity path; overseas-only packs stall at contracting.
- Catalog optimism — Front Door, DevOps, Fabric, Static Web Apps, and Arc-extension defaults copied from Global fail when rows are absent or partial.
- Global-only identity and endpoints — MSAL, Graph, and ARM defaults aimed at Global never become a China release train.
- Buying cloud before ICP — public websites stay non-publishable until filing clears.
- Global-only CI/CD and artifact feeds — pipelines that cannot reach China endpoints never ship.
- Support-model surprise — 21Vianet channels and China documentation replace global ticket assumptions.
- Confusing reachability with residency — speeding access for China users to global Azure is a different problem than running workloads inside Mainland China.
When Azure China fits
Choose Azure China when residency, regulator expectations, or domestic integration require workloads inside Mainland China — and you can run a China-local model: OSPA contract, China Entra tenant, filing, 21Vianet support, and a catalog-trimmed reference architecture.
It is usually the wrong first answer when the problem is reachability of a global Azure footprint to China users — latency and third-party dependency failures are a different class of work; see Cloudflare and China. For a side-by-side sovereign-cloud read, see AWS China. For provider-neutral route selection, see How we choose providers without selling them or start a China Readiness Assessment.
Minimum diligence before sign-off: confirm every required SKU in target China regions; parallel-track OSPA and entity work with architecture; scope CI/CD to AzureChinaCloud; align filing with DNS cutover.
When you need a China landing partner for Azure China
Most product teams exploring Mainland China entry need a China landing partner to open or operate the OSPA / subscription rail, remap identity and endpoints, trim the architecture to the real catalog, and align ICP / hosting with the same stack — not a longer portal tutorial. Your team still owns product and architecture decisions; the partner path makes entity, operator, and filing rails executable when they are not already in-house.
What we can offer?
Azure China is a 21Vianet partition — OSPA rails, China endpoints, catalog gaps, and ICP adjacency — not a global region toggle. Chinaready helps your product team decide whether Azure China fits and what must be true before public go-live:
- China Readiness Assessment — Map whether residency forces Azure China vs global reachability, which OSPA / entity rail you can execute, and which catalog gaps block the reference architecture.
- China Access Acceleration — Keep admin paths, dependencies, and hybrid links workable while Global and China stacks stay explicitly separate.
- China Product Hosting — Place China-critical workloads on a Mainland China–operable stack where ICP/PSB and Azure China endpoints describe one coherent publish path.
- Mobile App Distribution — Ship channel launches on their own gates while backend residency and China cloud choices stay consistent with the live product boundary.
Contact us when you need an Azure China vs global decision — OSPA rail, catalog trim, and filing adjacency — without treating China as a region checkbox.
References
- Microsoft Azure — product availability by region — source for catalog counts above; last checked 2026-06-27
- Products available by China regions — Microsoft China-filtered regional view
- Microsoft Azure operated by 21Vianet — overview and operations
- Service availability and roadmaps for Azure in China
- Azure in China checklist — contracting, compliance, and cross-border items
- Azure in China — purchase / OSPA concepts
- Azure in China — sovereignty and regulations
- Azure in China — connectivity and interoperability
- Azure in China developer guide
- Azure in China — support concepts
- National clouds and authentication
- Azure CLI — manage clouds
- Azure geographies
- Enable HTTPS for Azure App Service (Global) — managed certificate behavior on global App Service
- Azure in China marketing site
- AWS China — partition vs global accounts — Chinaready guide
- Cloudflare and China — Chinaready guide
- ICP and PSB filing for foreign companies — Chinaready guide
Frequently asked questions
Is Azure China just another region on my global Azure subscription?
No. Microsoft Azure operated by 21Vianet is a physically separated Azure instance inside Mainland China, independently operated and transacted by Shanghai Blue Cloud Technology (21Vianet). Global subscriptions, portals, and ARM planes do not span into China.
Who operates Azure China, and what is OSPA?
21Vianet operates Azure in China. Enterprise access starts with an Online Service Premium Agreement (OSPA) — OSPA Direct with 21Vianet, or OSPA Indirect via an authorized Azure China partner — not a global EA region toggle.
Can my product team finish Azure China onboarding without Mainland China ops?
Usually no. OSPA contracting, China Entra / endpoint remapping, catalog gaps, and ICP / PSB adjacency stop most product teams before a stable China reference architecture. Use this Guide as a decision map; execute with Mainland China ops rails or a China landing partner.
Do we need ICP filing to host on Azure China?
Public-facing websites on Mainland China infrastructure typically require ICP filing (recordal and/or license by content type) and public security (PSB) registration where applicable. Buying Azure China capacity does not clear the public publish gate — see our ICP and PSB Guides.
Which Azure services are missing in China vs global?
As of our 2026-06-27 parse of Microsoft’s products-by-region table, Azure China listed roughly half the product names of Azure public (~89 vs ~191). Common architecture gaps include Static Web Apps, Azure Front Door, Traffic Manager, Azure DevOps, and Microsoft Fabric. Always re-check the live China table and Microsoft’s Azure China service-differences page before sign-off.
How do CLI, portal, and identity differ from global Azure?
Day-to-day work uses portal.azure.cn, login.chinacloudapi.cn, *.chinacloudapi.cn / *.chinacloudapp.cn endpoints, and the AzureChinaCloud environment in CLI/SDK — not portal.azure.com defaults. There is no shared ARM plane with global subscriptions.
