Microsoft 365 in China in 2025, a practical decision guide for global IT

26 Aug

Written By Ben Fox

Who this is for
Regional IT leaders, CIOs, Heads of Infrastructure and Compliance who support offices or staff in Mainland China.

The short version
There are three viable approaches:

Stay on your global Microsoft 365 tenant, optimise networking for China, and use Teams cross‑cloud communications to talk to colleagues and partners in China. Best when your Mainland footprint is small, or you need features that lag in China. Microsoft Learn TECHCOMMUNITY.MICROSOFT.COM
Run a dedicated China tenant, “Microsoft 365 operated by 21Vianet,” for Mainland users, with cross‑cloud collaboration back to your global tenant via Microsoft Entra B2B. Best when you need data to stay in China or you have a sizeable China workforce. Microsoft Learn+1
Move everything to the China tenant. Rare outside China‑only businesses. Expect feature differences, separate identity and distinct operational processes. Microsoft Learn

Why Microsoft 365 in China is different

Different operator and legal scope. In Mainland China, Microsoft 365 is provided by 21Vianet from data centres in China. Microsoft licenses the technology; 21Vianet runs the service, billing and support. Services are subject to Chinese law. Microsoft Learn
Separate cloud and endpoints. Identity and APIs live on China‑specific endpoints, for example login.partner.microsoftonline.cn and microsoftgraph.chinacloudapi.cn. Admin access uses portal.partner.microsoftonline.cn. Azure Documentation Microsoft Learn GitHub
Different service domains. Examples include *.partner.outlook.cn for Exchange Online, *.sharepoint.cn for SharePoint and OneDrive, and teams.microsoftonline.cn for Teams. Plan your allow‑lists and proxies accordingly. Microsoft Learn
Feature differences and lag. Microsoft documents clear differences for 21Vianet tenants. Teams in China limits third‑party apps and some developer capabilities. Several Purview features exist, but availability is narrower than global and evolves on a different cadence. Microsoft Learn+1
Copilot note. Some Copilot admin experiences, such as the Copilot Dashboard, are not available in national clouds including 21Vianet at the time of writing. Treat Copilot coverage in China tenants as evolving and verify with Microsoft before planning. Microsoft Learn

Option 1: Stay on global, serve China users well

When to choose this

Fewer than about 100 Mainland users, or mostly travellers.
You depend on global‑only capabilities and partner integrations.
You want one tenant to manage.

What to do

Network first. Follow Microsoft’s China performance guidance. Many firms use private WAN or SD‑WAN to carry Microsoft 365 traffic to offshore breakouts, avoiding cross‑border congestion. Validate against local regulatory requirements. Microsoft Learn
Teams interop. Enable cross‑cloud communications so Teams users in China tenants can chat, call and meet with your global users. Confirm external access settings in both tenants. TECHCOMMUNITY.MICROSOFT.COM
SharePoint and OneDrive design. Keep heavy collaboration close to users. Avoid dependency on blocked consumer services. Plan caching and file sync carefully for China offices. Microsoft’s China URL set is essential for firewalls and QoS. Microsoft Learn
Email hygiene. If you keep Exchange Online globally, watch outbound reputation to China domains and consider regional smart‑host routing if deliverability dips.

Pros

One tenant to govern.
Full global features and integrations.

Cons

Performance and reliability depend on your network design.
Some cross‑border scenarios remain sensitive to latency and policy.

Option 2: Dual‑tenant, with Microsoft 365 operated by 21Vianet for China

When to choose this

Material headcount in China or strong data‑residency drivers.
Mainland workflows benefit from local hosting and routing.

What to design

Identity and access. Treat the China tenant as a separate Microsoft Entra directory. Use “Cross‑cloud B2B” to collaborate between your global and China tenants. Configure Microsoft cloud settings and cross‑tenant access both ways. Consider cross‑tenant sync for lifecycle management. Microsoft Learn+2Microsoft Learn+2
Authentication endpoints. Update SSO, Conditional Access and device compliance to the China endpoints, for example login.partner.microsoftonline.cn. Azure Documentation
Network and security. Allow‑list Microsoft 365 China URLs and IPs. Avoid tromboning China traffic out of the Mainland. Microsoft Learn
Teams experience. Enable cross‑cloud communications with your global tenant. Plan around restrictions on third‑party apps and bots in the China Teams service. TECHCOMMUNITY.MICROSOFT.COM Microsoft Learn
Purview and records. Check which Purview capabilities you rely on and map the 21Vianet availability. A trimmed Microsoft Information Protection and Governance SKU is now available in China with limited scope. Microsoft Learn
Intune and apps. Intune exists in the China cloud. Plan mobile app distribution without Google Play and prefer OEM or trusted local stores as per Microsoft notes. Microsoft Learn+1

Pros

Local data hosting and routing for China users.
Lower dependency on cross‑border links for day‑to‑day work.

Cons

Two tenants to govern, license and support.
Feature gaps, release lag and different admin surfaces.

Option 3: Move everything to the China tenant

When to consider

You operate only in Mainland China or have a China‑first strategy.
You accept the 21Vianet feature set and release cadence.

Key implications

All identity, security and admin move to the China cloud.
Contracts, SLAs and support are with 21Vianet. Microsoft Learn

Ten practical differences you must plan for

Operator, contracts and support provided by 21Vianet, not Microsoft. Microsoft Learn
Data residency within China for Microsoft 365 operated by 21Vianet. Microsoft Learn
Separate identity in a national cloud, with its own endpoints and app registrations. Azure Documentation
Admin portal is portal.partner.microsoftonline.cn for 21Vianet tenants. GitHub
Exchange Online domains change to *.partner.outlook.cn. Microsoft Learn
SharePoint and OneDrive use *.sharepoint.cn. Microsoft Learn
Teams features differ, with limits on third‑party apps and developer extensibility. Microsoft Learn
Teams cross‑cloud meetings and chats are supported between China and worldwide tenants with correct settings. TECHCOMMUNITY.MICROSOFT.COM
Purview and compliance features exist but with a narrower, evolving set in the China cloud. Microsoft Learn
Copilot admin experiences such as the Copilot Dashboard are not available in national clouds. Validate Copilot plans before committing. Microsoft Learn

Identity patterns that work

Two directories, one company. Keep your global Entra tenant and add the China Entra tenant for 21Vianet.
Cross‑cloud B2B. Enable Microsoft cloud settings, then set inbound and outbound access on both tenants. Use B2B direct connect for selected apps as needed. Microsoft Learn+1
Endpoints and policies. Update Conditional Access to China endpoints and review MFA prompts accordingly. Azure Documentation

SharePoint, OneDrive and Teams design for China users

Keep content close. For global tenants, minimise heavy co‑authoring across the border. Consider regional sites and content routing.
DNS and proxies. Allow the full Microsoft 365 China URL and IP list, and avoid SSL inspection where Microsoft advises. Microsoft Learn
Teams reality. Plan for the sovereign‑cloud feature set and remove reliance on third‑party apps in meetings. Microsoft Learn
Cross‑tenant collaboration. Use cross‑cloud Teams settings to allow chat, meetings and calling with colleagues on the other tenant. TECHCOMMUNITY.MICROSOFT.COM

Email routing and hygiene options

Global tenant retained. Keep Exchange Online globally and tune anti‑spam, transport rules and smart‑host paths for China mail flows.
21Vianet tenant. Use the China Exchange Online endpoints, for example *.partner.outlook.cn, and review EOP policies in that cloud. Microsoft Learn

Network patterns that actually help

For global tenants. Many firms use private WAN or SD‑WAN to reach offshore Microsoft 365 breakouts, reducing cross‑border congestion. Validate local rules before deployment. Microsoft Learn
For 21Vianet tenants. Break out locally in China to the documented Microsoft 365 China endpoints. Avoid sending China Microsoft 365 traffic out of the Mainland and back. Microsoft Learn

Compliance and cross‑border data transfers

Know the three legal channels. Under China’s PIPL framework, the main routes are:
- CAC security assessment.
- Certification by a recognised institution.
- Standard Contract filing with the CAC. Recent provisions introduced targeted exemptions that can simplify some transfers. Work with counsel to pick the right mechanism. Clifford Chance Arnold & Porter

Roll‑out checklist and indicative sequence

Confirm approach, global only or dual‑tenant.
Map data flows and decide what must stay in China.
Design identity, including cross‑cloud B2B settings. Microsoft Learn
Build network plan and China allow‑lists. Microsoft Learn
Define Teams external access between clouds. TECHCOMMUNITY.MICROSOFT.COM
Validate Purview needs against China availability. Microsoft Learn
Pilot with one China office and one business unit.
Train admins on the China admin portal and endpoints. GitHub Azure Documentation
Finalise compliance records for cross‑border data. Clifford Chance

Budget items people miss

Second tenant licences and support overhead in dual‑tenant designs.
Network changes for China connectivity and monitoring.
Third‑party tools for content migration if you move any workloads between tenants. Microsoft Learn
Change management for different Teams and Purview capabilities. Microsoft Learn+1

FAQs

Is Microsoft 365 Copilot available in the China cloud?
Some Copilot admin experiences, such as the Copilot Dashboard, are not available in national clouds including 21Vianet. Treat coverage as evolving and confirm with Microsoft before budgeting. Microsoft Learn

Can staff in China meet with overseas colleagues on Teams?
Yes. Cross‑cloud communications support chat, calls and meetings between 21Vianet and worldwide Teams tenants when external access is configured in both. TECHCOMMUNITY.MICROSOFT.COM

Can we collaborate across the global and China tenants with one identity per user?
You will run two Entra tenants. Use cross‑cloud B2B to grant access between them and optionally use cross‑tenant sync to automate lifecycle. Microsoft Learn+1

What are the key China login and service URLs we must allow?
Examples include login.partner.microsoftonline.cn, microsoftgraph.chinacloudapi.cn, *.partner.outlook.cn, *.sharepoint.cn, teams.microsoftonline.cn. Use Microsoft’s published list for the full set and IPs. Microsoft Learn Azure Documentation

If we ever move workloads between tenants, is it supported?
Microsoft provides cross‑tenant migration patterns and many organisations use partners and tools. Plan carefully, especially across clouds. Microsoft Learn

What good looks like

A written decision that states which users and data live in which cloud, and why.
Firewall and proxy rules that match Microsoft’s China endpoint list. Microsoft Learn
Cross‑cloud Teams external access tested both ways. TECHCOMMUNITY.MICROSOFT.COM
Compliance paperwork that cites your chosen PIPL transfer mechanism for any cross‑border flows. Clifford Chance

Ready to act?

PTS designs and delivers both models. Typical next steps:

An architecture review to validate global‑only versus dual‑tenant.
A China network and Teams interop test plan for one pilot office.
A compliance work‑through on data flows and documentation.

Ben Fox