Azure China — overview, services, and what differs from global Azure
Azure operated by 21Vianet is a separate cloud, not a global region. As of 2026-06-27, the China catalog lists roughly half the product names of Azure public — plus distinct onboarding, endpoints, and filing rules.
Microsoft Azure operated by 21Vianet (Azure China) is a physically isolated Azure instance inside Mainland China — sold and operated by Shanghai Blue Cloud Technology (21Vianet), not Microsoft global. It is not a region switch on an existing global subscription.
Teams that treat it as “Azure plus China” usually discover the gap at contracting, identity setup, or architecture review — when a global SKU, portal, or Terraform module simply does not exist in the China catalog.
Catalog snapshot (2026-06-27)
We parsed Microsoft’s Product availability by region on 2026-06-27, comparing Azure Global (all public geographies excluding China and Azure Government) with China (operated by 21Vianet).
| Metric | Azure Global | Azure China |
|---|---|---|
| Product names | ~191 | ~89 |
| Product / SKU combinations | ~516 | ~247 |
| Product names in Global but not in China table | — | ~102 |
Microsoft’s own documentation states a feature parity gap that is narrowing. Product-name counts understate SKU gaps; regional tables alone can miss control-plane services. For sign-off, cross-check the availability table with the Azure China service differences page and target SKUs in your regions.
Regions
China North, China North 2, China North 3, China East, China East 2, and China East 3 appear in the regional table. Regions marked * carry reserved-access restrictions. Pairing, disaster recovery, and ExpressRoute rules follow China-specific guidance — not the global region-pair matrix.
Control plane and contract
| Dimension | Azure Global | Azure China |
|---|---|---|
| Operator | Microsoft | 21Vianet |
| Portal | portal.azure.com | portal.azure.cn |
| Subscription | Global EA / CSP / PAYG | China subscription under OSPA (direct or indirect) |
| Sign-in / Entra | login.microsoftonline.com | login.chinacloudapi.cn |
| Resource endpoints | *.windows.net, *.azure.com | *.chinacloudapi.cn, *.chinacloudapp.cn |
| CLI / SDK | Default cloud | AzureChinaCloud |
| Cross-cloud ARM | — | No shared plane with global subscriptions |
Migration means redeploying workloads, re-creating identity, and re-pointing integrations — not extending an existing resource group across the boundary.
Obtaining an enterprise account
China access starts with a signed service agreement — not a global subscription toggle. Commercial entry is through OSPA Direct with 21Vianet or OSPA Indirect via an authorized Azure China distributor. Both paths require a contract before a tenant or subscription is usable.
Path 1 — Microsoft China Azure sales. Large domestic enterprises tend to get the fastest response. The contract may be signed directly with 21Vianet, but Azure China workloads more often flow through Microsoft’s indirect distributor channel rather than a pure direct sale.
Path 2 — Authorized distributor. Select a partner from Microsoft’s Azure China partner directory and sign using a PRC legal entity. This is the standard route for foreign-owned companies that already have — or are forming — a local operating company.
Working either path without local relationships typically takes at least two months to reach a firm outcome. Some programs stall indefinitely when entity verification, OSPA legal review, or distributor fit never closes.
Landing partner. Teams that lack confidence in either path — or need a predictable timeline — can provision through a landing partner such as Chinaready. Under Chinaready engagement: a standalone China Entra tenant is committed within 35 days; an additional subscription under Chinaready’s existing tenant within 10 days. Start an assessment.
Other onboarding blockers still apply: wrong portal or ARM endpoint, filing tracks that lag cloud purchase, SKUs missing from the China catalog, and support routed through 21Vianet rather than global Azure. Customer-facing sites on Mainland China infrastructure still require ICP filing before go-live and PSB filing within 30 days where applicable — see our ICP and PSB guide. Hybrid designs need explicit cross-border network paths; ExpressRoute paired-region rules in China differ from global.
High-level differences by service domain
Source: Product availability by region parsed 2026-06-27, cross-checked with Azure China service differences.
| Service domain | Azure China availability | Main differences vs Azure Global |
|---|---|---|
| Core compute | VM, VMSS, Batch, Cloud Services, Dedicated Host, and related services available | Fewer VM series and SKU coverage than Global; some legacy SKUs retiring |
| App hosting | App Service, Functions, API Management available | Static Web Apps not listed in the China regional table; fewer App Service and Functions plan types; no free App Service Managed Certificate (see below) |
| Containers | AKS, ACI, ACR, Container Apps, Kubernetes Fleet Manager available | Azure Red Hat OpenShift and Container Storage not listed; Container Apps Azure Monitor integration not supported in China |
| Storage | Storage, Blob tiers, Files, Disk, Data Lake Gen2, Backup, Data Box available | Elastic SAN, NetApp Files, Storage Mover, Storage Actions, Managed Lustre not listed |
| Databases | SQL DB, SQL MI, MySQL, PostgreSQL, Cosmos DB, Redis available | Cassandra MI, Oracle Database@Azure, and some advanced or industry database services not listed |
| Analytics | Data Factory, Synapse, Databricks, Data Explorer, Stream Analytics available | Microsoft Fabric, Data Share, Data Manager for Energy not listed |
| AI / ML | Azure AI Search, Azure ML, Speech, Vision, Language, Document Intelligence available via Microsoft Foundry / AI services | Azure Health AI and some Foundry / OpenAI capabilities require separate verification; official China difference pages document AI service variants — not full Global parity |
| Integration and messaging | Event Grid, Event Hubs, Service Bus, Logic Apps, SignalR, Web PubSub available | Some SKUs and regions limited |
| Network | VNet, VPN Gateway, ExpressRoute, Private Link, Firewall, App Gateway, WAF, DNS, Virtual WAN available | Azure Front Door, Traffic Manager, Peering Service, Network Security Perimeter not listed; CDN is a China-specific offering |
| Security | Key Vault, Managed HSM, Defender for Cloud, Sentinel covered | Defender TI, Defender for IoT, Defender for DevOps, Customer Lockbox not listed or require separate verification |
| Identity / control plane | China-dedicated portal, login, Graph, and ARM endpoints | Endpoints entirely separate from Global; B2B, B2C, and MSAL have China-specific difference documentation |
| Hybrid cloud / Arc | Arc-enabled servers, Arc-enabled Kubernetes, Azure Local covered | Arc VMware, Arc SCVMM, Arc SQL, AKS on Arc, and many other Arc extensions not listed; multiple extensions unsupported on Arc-enabled Kubernetes |
| DevOps / developer | Base ARM, API, and Marketplace available in China editions | Azure DevOps, Dev Box, Deployment Environments, App Testing, Lab Services not listed |
| Professional / industry | Limited industry and governance capabilities available | Quantum, Maps, VMware Solution, Large Instances, Education, Universal Print not listed |
App Service TLS certificates
On Azure Global, App Service offers a free App Service Managed Certificate: Azure issues, renews, and binds TLS for custom domains on supported plans. Key Vault can store imported certificates and integrate with App Service for rotation and binding.
Azure China App Service documentation does not document an equivalent free managed certificate. Teams typically obtain a certificate from a third-party or internal CA, upload it to App Service, or import into Key Vault and wire the binding through the China portal workflow. Plan certificate procurement, renewal ownership, and filing-aligned domain timing in the same workstream as App Service deployment — not after go-live.
Service availability matrix (Azure Global vs Azure China)
Same source and date as above. Yes = listed in the China regional table; No = not listed; Partial = listed with documented China limitations.
| Azure service | Global | Azure China | Notes |
|---|---|---|---|
| Virtual Machines | Yes | Yes | Fewer VM SKUs in China than Global |
| Virtual Machine Scale Sets | Yes | Yes | Available |
| App Service | Yes | Yes | Premium v3 and ASE covered; no free managed certificate |
| Azure Functions | Yes | Yes | Consumption, Dedicated, and Premium plans covered |
| Static Web Apps | Yes | No | Not listed in China regional table |
| API Management | Yes | Yes | Available |
| AKS | Yes | Yes | Available; fewer ecosystem extensions |
| Azure Red Hat OpenShift | Yes | No | Not listed in China regional table |
| Container Registry | Yes | Yes | Available |
| Container Apps | Yes | Partial | Available; Azure Monitor integration not supported |
| Storage Account / Blob | Yes | Yes | Available |
| Azure Files | Yes | Yes | Available |
| Azure NetApp Files | Yes | No | Not listed in China regional table |
| Azure SQL Database | Yes | Yes | Available |
| Azure SQL Managed Instance | Yes | Yes | Available |
| Cosmos DB | Yes | Yes | Available |
| MySQL Flexible Server | Yes | Yes | Available |
| PostgreSQL Flexible Server | Yes | Yes | Available |
| Data Factory | Yes | Yes | Available |
| Synapse Analytics | Yes | Yes | Available |
| Databricks | Yes | Yes | Available |
| Microsoft Fabric | Yes | No | Not listed in China regional table |
| Azure AI Search | Yes | Yes | Available |
| Azure Machine Learning | Yes | Partial | Available; China feature differences documented |
| Key Vault | Yes | Yes | Managed HSM also covered |
| Azure Monitor | Yes | Yes | Application Insights and Log Analytics covered |
| Microsoft Sentinel | Yes | Partial | China availability caveats apply |
| Virtual Network | Yes | Yes | Available |
| Private Link | Yes | Yes | Confirm availability per target service |
| ExpressRoute | Yes | Yes | Paired-region free-circuit rules apply in China |
| Azure Firewall | Yes | Yes | Basic, Standard, and Premium covered |
| Application Gateway / WAF | Yes | Yes | Available |
| Azure Front Door | Yes | No | Not listed in China regional table |
| Traffic Manager | Yes | No | Not listed in China regional table |
| Azure DevOps | Yes | No | Not listed in China regional table |
| Azure Virtual Desktop | Yes | No | Not listed in China regional table |
| Azure VMware Solution | Yes | No | Not listed in China regional table |
| Azure Arc-enabled servers | Yes | Yes | Available |
| Arc-enabled Kubernetes extensions | Yes | Partial | APIM, App Service, Dapr, Event Grid, ML, Defender, and other extensions not supported |
When Azure China fits
Choose Azure China when residency, regulator expectations, or domestic integration require workloads inside Mainland China — and you can run a China-local model: OSPA contract, China Entra tenant, filing, 21Vianet support, and a catalog-trimmed reference architecture.
It is usually the wrong first answer when the problem is reachability of a global Azure footprint to China users — latency and third-party dependency failures are a different class of work; see Cloudflare and China. For provider-neutral route selection, see How we choose providers without selling them or start a China Readiness Assessment.
Minimum diligence before sign-off: confirm every required SKU in target China regions; parallel-track OSPA and entity work with architecture; scope CI/CD to AzureChinaCloud; align filing with DNS cutover.
References
- Microsoft Azure — product availability by region — source for catalog counts above; last checked 2026-06-27
- Microsoft Azure operated by 21Vianet — overview and operations
- Service availability and roadmaps for Azure in China
- Azure geographies
- Azure in China checklist — contracting, compliance, and cross-border items
- Enable HTTPS for Azure App Service (Global) — managed certificate behavior on global App Service
- ICP and PSB filing for foreign companies — Chinaready guide
